Free SOC 2 tools
Every one of these renders its full answer on screen. Nothing asks for an email address to show you a number, and the field underneath buys only the written version.
A first SOC 2 is a short list of decisions: whether a report can exist by the date somebody gave you, which report you are buying, which criteria it covers, where its boundary sits, how much evidence that boundary produces, what it costs in Canadian dollars, and who should do it. There is a free tool for each, and none of them holds the answer back.
| Tool | The question it answers | Questions |
|---|---|---|
| Deadline back-calculator | Our customer needs the report by a date. What can honestly exist by then | 6 |
| Type 1 or Type 2 decider | Do we buy a Type 1 now, go straight to a Type 2, or wait | 5 |
| Observation window planner | When does the Type 2 window have to open, and when does the report realistically arrive | 7 |
| Trust services criteria selector | Which categories beyond Security do we actually need, and what does each add | 7 |
| Scope builder | What is inside the system description boundary, and carve-out or inclusive | 9 |
| Evidence request estimator | How many evidence items will the audit ask for, and which areas carry them | 8 |
| Evidence request triage | Is this request from our auditor reasonable, and what do we send | 6 |
| Questionnaire readiness | Could we answer an enterprise security questionnaire today, and what would we fail | 13 |
| Cost calculator | What will a first SOC 2 cost us in Canadian dollars, across all four lines | 7 |
| Auditor match | Which category of audit firm fits the buyer we are trying to satisfy | 5 |
| All nine, start to finish | A complete picture of a first SOC 2 | 67 |
The order worth using them in
- If a customer has named a date, start with the deadline back-calculator. It decides everything downstream, because the observation window either fits or it does not.
- Then the Type 1 or Type 2 decider, which turns that timing answer into a purchase.
- If the answer is a Type 2, the observation window planner puts real dates on the window, the fieldwork and the report.
- Then the trust services criteria selector and the scope builder, which between them define what the report covers. Both belong before you ask anyone to price it.
- Then the evidence request estimator, which turns that scope into the internal effort nobody budgets for.
- Then the cost calculator, once you know which report you are budgeting for. The two report types differ by tens of thousands of Canadian dollars.
- Then auditor match, when you are ready to approach firms, and take the answer to the quote form.
Once fieldwork starts, the evidence request triage check takes one request from the auditor at a time and tells you whether it is typical for your scope and what to send.
The questionnaire readiness check sits outside that sequence. Use it when a form arrives and you need to know today whether you can answer it, or before you commit to a SOC 2 at all, because it scores the same control areas the common criteria test.
Why nothing is gated
A tool that computes a number and then asks for an email address to reveal it has not helped anybody. Every result here renders in full on the page. The email field sits underneath and buys one thing: the same answer written up with its reasoning and its assumptions, the version you forward to a finance team or to the customer who set the deadline. Skipping it costs you nothing.
Where the numbers come from
Every figure is a Canadian dollar range rather than a computed-looking single number. A fee is built from estimated engagement hours, and nobody can price your scope without seeing it. The bands and the multipliers behind each tool are printed on its own page, so you can check the model rather than trust it. The cost breakdown works through the same figures in prose, and the audit fee page takes the examination line apart on its own.
Common questions
Do I have to give you an email address to see the results?
No. The full result renders as soon as you finish the questions. The email field underneath sends the same answer written up with its reasoning and assumptions, which is useful if you need to forward it, and skipping it costs you nothing.
How accurate are the cost ranges?
They are ranges rather than quotes, and each page shows the bands and multipliers they were built from. A real quote depends on how many systems are in scope and how much control work is already done, which is what the quote form is for. If a firm quotes you well outside the range, that is worth asking about rather than assuming either side is wrong.
Will firms contact me because I used a tool?
Only if you ask. Nothing is sent anywhere unless you fill in the email field, and asking for quotes is a separate deliberate step.
Which tool should I use first?
The deadline back-calculator, if a customer has given you a date. It is the only question whose answer cannot be changed by spending money, so everything else follows from it. With no date in play, start with the criteria selector and the scope builder, because scope decides every number downstream.
Do the tools share anything between them?
No. Each one starts from a blank page and nothing is stored between visits. That is deliberate, and it means you can run the same tool three times with different assumptions to see which input the answer is actually sensitive to, which is usually the most useful thing any of them tell you.
Get quotes with your numbers attached
Take the answers straight into the quote form and Canadian firms price the scope you already worked out.
Get matched