Do I need Vanta or another compliance platform for SOC 2?

No criterion requires one. TCSA, a consulting firm, says nothing in the standard asks for software, and Agency, which sells GRC platforms, answers the same question with "Strictly, no". What you cannot skip is the examination by a licensed CPA firm. Whether a platform is worth its fee for you depends on how much evidence you would otherwise collect by hand, which grows with headcount, frameworks and the length of the observation period.

Can a CPA firm work from a spreadsheet and a shared drive?

Firms differ, so ask yours before you sign. What the sources describe is evidence the auditor can test: TCSA says auditors accept only evidence dated inside the period under review, and its platform-free route is a structured shared drive with one folder per control and dates in the file names. A firm that is used to platform exports may ask for a different format, but nothing in the criteria says the evidence has to come from software. Ask each firm in writing what form of evidence it expects.

Is a consultant required for a first SOC 2?

No criterion requires one. TraceLayer, which sells a compliance platform, says a consultant is not needed if you have a technical person who can own the program, and lists cases where one may help: a highly regulated industry, enterprise prospects who ask for more than SOC 2, no technical owner, or an audit needed within 60 days with no evidence yet. That is one seller's view. A consultant who prepares you is separate from the CPA firm that examines you, and only the CPA firm can issue the report.

Can I add a platform later if the manual route gets heavy?

Yes. Nothing about doing the first period by hand stops you from buying a platform for the next one, and the policies you wrote are text you can bring with you. If you plan to switch mid-period, tell your CPA firm first: evidence from two systems still has to show every control operating across the whole window, so ask how they want it presented.

What does a missed evidence item actually cost?

In a Type 2 examination, a control that did not run on its stated schedule is visible to the auditor. TCSA says a quarterly access review skipped in March cannot be recreated in November, and Agency says that evidence is a time series in which gaps are findings. The cost is the exception in your report and whatever your customers make of it, which is why the calendar matters more than the folder structure.

Is Policyseed a compliance platform?

No. Policyseed sells a kit, and this page is written by the seller. The generator is free and writes 22 policy drafts from 23 questions in your browser. The Audit Kit costs $59, one time, for one company, and adds tailored Word policies, registers and audit-prep drafts. Policyseed has no integrations with your systems, does not collect evidence and does not monitor anything. You still run the controls, keep the records and hire the CPA firm.

SOC 2 without a compliance platform: what you still need

Updated 26 October 2026

You can do SOC 2 without a compliance platform. You cannot do it without a licensed CPA firm, because the report is the firm's opinion on your controls. What a platform sells is convenience: it collects evidence, watches for drift and nags people on schedule. This guide lists those functions, shows the manual equivalent of each, names the recurring work you take on, and sets the published cost figures side by side with who is selling what. Policyseed sells a kit, so it has an interest in this topic; the page says so again where it describes the kit.

Short answer: software is optional, the CPA firm is not

TCSA, a consulting firm, says nothing in the standard asks for software (TCSA). Agency, which sells managed services and GRC platforms, answers the same question with "Strictly, no" (Agency). What both describe is the same: SOC 2 asks for controls and evidence that they operated, not for any particular tool.

The part that is not optional is the examination. TCSA describes it as a licensed CPA firm examining your controls and signing an opinion (TCSA), and TraceLayer, which sells an evidence platform, says no tool, consultant or internal team can replace that firm (TraceLayer). See why SOC 2 is a report, not a certificate and how to choose a SOC 2 auditor.

Every source on this page sells something, including Policyseed. Where a seller's claim favors its own product, the text says whose claim it is.

What a platform does for you

TCSA lists six functions in a table and calls the bundle conveniences, each with a plain equivalent (TCSA):

An evidence store.
Automated evidence collection.
Continuous monitoring.
Policy templates.
A task dashboard with reminders.
An auditor marketplace.

Agency describes the ongoing work the same way: keeping the control matrix, running quarterly access reviews and chasing sign-offs are the tasks a platform automates, and most companies use one anyway because tracking evidence by hand over months invites missed items (Agency). That is a seller's view, and it is also the honest cost of the manual route: the work does not disappear, it moves to your people.

The platform-free route, function by function

The middle column is TCSA's description of the manual equivalent (TCSA). The right column is the free Policyseed page that helps with that function. None of them collects anything from your systems for you.

Platform function	Manual equivalent (TCSA)	Free Policyseed page
Evidence store	A structured shared drive: one folder per control, dates in the file names.	The evidence checklist lists what each control leaves behind.
Automated evidence collection	Exports from your identity, logging, device management and backup systems, taken on a schedule.	The access review tool builds the workbook for the quarterly review you fill in from those exports.
Continuous monitoring	The monitoring your cloud provider already gives you.	SOC 2 logging requirements says what to switch on and keep.
Policy templates	Written policies, approved and acknowledged.	The generator writes all 22 policy drafts from 23 questions, in your browser, with no signup.
Task dashboard and reminders	A recurring calendar with a named owner for each artifact, and your ticket system for approvals, access reviews and change records.	The timeline planner builds a dated plan you can download as Excel or a calendar file.
Auditor marketplace	Your own quotes from two or three CPA firms for the same scope.	How to choose a SOC 2 auditor.

TCSA also suggests working the auditor's evidence request list as your checklist in place of a platform dashboard (TCSA). To see where you stand before you start, the readiness assessment gives a score and a gap list.

The recurring work you now run by hand

In a Type 2 examination the CPA firm samples your controls across an observation period, so each control needs a cadence and a named owner. TCSA says auditors accept only evidence dated inside the period under review, and that a quarterly access review skipped in March cannot be recreated in November (TCSA). Agency says the same thing from the other side: evidence is a time series, gaps are findings, and a missed item in a Type 2 window cannot be recreated afterward (Agency).

For a typical small SaaS team, the Policyseed templates commit you to this recurring work by default. The observation period guide has the full calendar, with the policy section behind each line:

Access reviews each quarter, with the removals done and recorded. The access review tool builds the sheet, and the onboarding and offboarding checklist covers joiners and leavers.
Vulnerability scans and patching: findings reviewed weekly and a patch cycle each month.
Training for all staff and for new starters, with a completion record. The security awareness training pack has a tracker.
Policy acknowledgment when someone joins and after each revision. See the acknowledgment guide.

The cadence you write in a policy is the cadence you will be held to, so write one you will keep. A control that runs but leaves no dated record looks, to an auditor, like one that did not run.

What the sources say it costs, side by side

These are four sellers' own estimates. They are not comparable line for line, because each counts different things, and this page does not add them up or claim a saving. Read the last column first.

Whose estimate	Figure as published	What the source says it includes
TCSA, a consulting firm that sells this service (TCSA)	$2,500 to $5,000 for a Type 1, $3,000 to $10,000 for a Type 2, labeled indicative	Its own engagement, all-in and fixed before it starts, with the CPA firm's attestation included.
Agency, which sells managed services and GRC platforms (Agency)	$25,000 to $60,000+ for doing it without a platform	Tooling, the audit and engineering hours, counted in dollars. Agency presents it as spend moving from software to staff time.
TraceLayer, which sells an evidence platform (TraceLayer)	$12,000 to $30,000 do-it-yourself, against $80,000 to $150,000 with consultants	Its do-it-yourself itemization: a platform at $0 to $1,800 a year, an audit by a startup-focused firm at $8,000 to $20,000, a penetration test at $3,000 to $8,000, and 40 to 80 hours of engineering time over six months, listed as hours.

The ranges differ because the lines differ. TCSA's figure includes the attestation and prices a fixed-fee engagement. Agency puts a dollar value on engineering time. TraceLayer lists that time in hours and prices a low-cost platform. TCSA also notes that the audit is billed on top of a platform subscription when you buy one (TCSA). For the CPA firm's fee and optional lines priced by other publishers, see what SOC 2 costs for a startup. Get written quotes for your own scope before you decide anything.

When a platform earns its fee

The same sources that say a platform is optional also say when it stops being optional in practice.

The calendar keeps slipping. TCSA says that if your evidence calendar keeps slipping and no one owns it, buy the platform (TCSA).
More than one framework. TCSA says running SOC 2 alongside other frameworks multiplies the evidence calendar, and one system of record can serve several (TCSA). Agency names a second framework on the horizon as a reason as well (Agency).
Fast headcount growth. TCSA says access reviews scale with people (TCSA). Agency suggests a platform for a Type 2 report or a growing team, and says a manual approach can work for a single small product on a Type 1 timeline if someone enjoys the discipline (Agency).
One engineer's time is the constraint. GreyNoise, a customer rather than a seller, used Secureframe, recommends an automation vendor "for time and sanity's sake" and estimates a platform saved over a hundred hours of work. It also found it best to mix and match, using free open-source tools where they were enough (GreyNoise, Reid Huyssen, 2023).

If none of these describes you, a single person who owns the calendar can run the manual route. If one does, the subscription is paying for hours you would otherwise spend. Either way, ask the CPA firm what evidence format it expects before you commit.

Where Policyseed fits

Policyseed sells a kit, so weigh this section accordingly. The generator is free: 23 questions about your company produce 22 policy drafts in your browser, with no signup. The Audit Kit costs $59, one time, for one company. It tailors the 22 policies to the tools you named, as editable Word files, and adds registers and audit-prep drafts: a system description, a gap assessment, interview prep and a dated plan. It also includes a review calendar file for the policy reviews. The free vs paid comparison shows what each option contains.

Policyseed is not an evidence-collection platform. It has no integrations with your cloud, identity or ticketing systems, it does not collect evidence, and it does not monitor anything. It will not remind you that an access review is due beyond the calendar file. The kit covers the policy and document side of the manual route above: the policies, the registers and the drafts. The recurring work, the evidence and the CPA firm stay yours.

Frequently asked questions

Do I need Vanta or another compliance platform for SOC 2?: No criterion requires one. TCSA, a consulting firm, says nothing in the standard asks for software, and Agency, which sells GRC platforms, answers the same question with "Strictly, no". What you cannot skip is the examination by a licensed CPA firm. Whether a platform is worth its fee for you depends on how much evidence you would otherwise collect by hand, which grows with headcount, frameworks and the length of the observation period.
Can a CPA firm work from a spreadsheet and a shared drive?: Firms differ, so ask yours before you sign. What the sources describe is evidence the auditor can test: TCSA says auditors accept only evidence dated inside the period under review, and its platform-free route is a structured shared drive with one folder per control and dates in the file names. A firm that is used to platform exports may ask for a different format, but nothing in the criteria says the evidence has to come from software. Ask each firm in writing what form of evidence it expects.
Is a consultant required for a first SOC 2?: No criterion requires one. TraceLayer, which sells a compliance platform, says a consultant is not needed if you have a technical person who can own the program, and lists cases where one may help: a highly regulated industry, enterprise prospects who ask for more than SOC 2, no technical owner, or an audit needed within 60 days with no evidence yet. That is one seller's view. A consultant who prepares you is separate from the CPA firm that examines you, and only the CPA firm can issue the report.
Can I add a platform later if the manual route gets heavy?: Yes. Nothing about doing the first period by hand stops you from buying a platform for the next one, and the policies you wrote are text you can bring with you. If you plan to switch mid-period, tell your CPA firm first: evidence from two systems still has to show every control operating across the whole window, so ask how they want it presented.
What does a missed evidence item actually cost?: In a Type 2 examination, a control that did not run on its stated schedule is visible to the auditor. TCSA says a quarterly access review skipped in March cannot be recreated in November, and Agency says that evidence is a time series in which gaps are findings. The cost is the exception in your report and whatever your customers make of it, which is why the calendar matters more than the folder structure.
Is Policyseed a compliance platform?: No. Policyseed sells a kit, and this page is written by the seller. The generator is free and writes 22 policy drafts from 23 questions in your browser. The Audit Kit costs $59, one time, for one company, and adds tailored Word policies, registers and audit-prep drafts. Policyseed has no integrations with your systems, does not collect evidence and does not monitor anything. You still run the controls, keep the records and hire the CPA firm.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.