🎯 The business: European software companies that want U.S. customers keep hitting the same wall: the U.S. buyer’s security team asks for a SOC 2 report. You get them ready. You find the gaps, write the policies, set up the controls and the evidence with their engineers, and stand with them through the audit by an independent CPA firm. You know what U.S. buyers and auditors expect; they know their product. It is a service export paid by the project and the month.
At a glance
| Money to start | ≈ $3,350 |
| Time to the first paid project | About 2 to 4 months |
| Hours a week | 10 to 15 beside a job at first; 25 to 35 billable when full time |
| Skills that matter most | Hands-on security and cloud experience, knowing the SOC 2 criteria and how auditors test them, clear writing, patience with engineers |
| A realistic income line | Four readiness projects and three retainers a year leave about $141,000 before tax; year one is often a third of that |
Is this for you?
It suits someone who has run security or compliance at a software company, worked at an audit firm on SOC 2 engagements, or built the controls as a cloud engineer. You need to have done this before. Founders hire you to get through the audit the first time without wasting a quarter of their engineers’ time.
It is a poor fit if you want to be the auditor. Only a licensed CPA firm can issue a SOC 2 report, and that firm must be independent of the work it tests. Your job is to make the company ready, then step back.
Who pays, and what
Software companies with roughly 10 to 200 staff in places such as Germany, the Netherlands, the Nordic countries, Ireland and the UK, selling to U.S. businesses. In Europe, ISO 27001 is the more familiar standard; U.S. procurement teams ask for SOC 2. A deal stuck in a security review is the moment they call.
They pay you a fixed fee for a readiness project, then often a monthly retainer through the observation period and the audit. Separately, they pay the CPA firm for the audit and usually a compliance platform (Vanta, Drata and Secureframe are common ones) to collect evidence. Published estimates for a small company’s first Type I audit start around $5,000 to $25,000; Type II costs more. Tell the client the full budget up front.
What it takes to start
| LLC filing and a free EIN | $150 |
| Website, email, video and e-signature tools, one year | $400 |
| Professional liability (E&O) and cyber insurance, first year | $1,500 |
| Training or a certification exam (optional) | $800 |
| Consulting contract reviewed by an attorney | $500 |
| All-in | ≈ $3,350 |
Clients will ask for your insurance certificate and, often, your own security practices. Get quotes for professional liability and cyber cover from two brokers; the figure above is an example. Keep your own laptop, accounts and client files locked down from day one.
Start to finish: the steps
1. Define the offer. A fixed-price readiness project (gap assessment, policies, control design, evidence setup, audit support) and a monthly retainer after it. Say plainly what you do not do: you do not issue the report.
2. Build your kit. A gap-assessment workbook mapped to the trust services criteria, a policy set you can tailor in days, a control matrix, and a sample project plan. These make your fixed prices safe.
3. Set up the business. LLC, EIN, business bank account, a multi-currency account for euro and pound payments, insurance, and a contract with a liability cap, payment milestones and a data processing agreement.
4. Meet the audit firms. Get to know three or four CPA firms that audit small software companies and their European clients. They need ready clients; you need auditors who answer. Keep it a referral relationship, not a paid one; audit firms are limited in what they can pay or accept for referrals.
5. Write to fifty software firms. Target European companies whose sites list U.S. customers or a U.S. office but no SOC 2 report. Two paragraphs: who you are, what the project costs, how long it takes, and one client result.
6. Run the first gap assessment. Two weeks: interviews, a look at their cloud setup and HR process, and a written report ranking the gaps by effort. It is often paid on its own and turns into the full project.
7. Fix, write and wire up. Policies the team will actually follow, access reviews, onboarding and offboarding, change management, vendor reviews, backups and incident response. Connect the compliance platform so evidence collects itself.
8. Hand over to the auditor. Help pick the audit firm and the scope, prepare the system description with the client, and answer the auditor’s requests during fieldwork.
9. Keep them through Type II. A monthly retainer covers the observation period, quarterly access reviews, the next year’s audit and security questionnaires from U.S. customers.
10. Then grow: add ISO 27001 or U.S. privacy work for the same clients, or bring in a second consultant you train on your kit.
Pricing
| Readiness project: gap assessment 20 h, policies 25 h, controls 30 h, evidence setup 15 h, audit support 10 h | 100 hours |
| At $150 an hour | $15,000 |
| Quoted fixed price | $15,000 |
| Paid 40 / 40 / 20 percent (start, policies done, audit begins) | $6,000 / $6,000 / $3,000 |
| Retainer after the project, about 15 hours a month | $2,500 a month |
| Paid by the client to others (example): CPA audit and compliance platform | Quoted separately |
These are example figures. Consultant fees for SOC 2 readiness vary widely with company size and how much the client does itself. Quote in euros or pounds if the client prefers, and price the exchange rate on the day you quote. See Export pricing and Getting paid abroad.
The math
A full year: four readiness projects at $15,000 is $60,000, and three clients on a $2,500 retainer for twelve months is $90,000, for $150,000 billed. Costs: insurance $1,500, tools $1,200, one trip to Europe $3,000, currency and payment fees at about 1 percent $1,500, and marketing $1,800, a total of $9,000. That leaves $141,000 before tax.
The hours: 4 × 100 = 400 project hours plus 3 × 15 × 12 = 540 retainer hours, 940 billable hours a year, about 20 a week. A realistic first year is two projects and one retainer for six months: $30,000 plus $15,000, $45,000 billed. Set aside a quarter to a third for income and self-employment tax.
Getting buyers to say yes
Founders say yes to a fixed price, a clear timeline and someone who has done it before. Show a sample project plan, a redacted gap report and the names of audit firms you have worked with. Offer the gap assessment as a small first step. A founder you got through an audit will refer you to others.
Where to find them: European software firms with U.S. customers listed on their sites, founders posting about stalled U.S. deals, startup programs with U.S. expansion tracks, and the audit firms and compliance platforms that need consultants to refer. Time-zone overlap is your morning and their afternoon.
Running it week to week
A weekly call with each project client, a shared tracker of controls and evidence, and a written status note every Friday. Track hours against every fixed-price project so your next quote is better. Invoice the day a milestone is met. Keep each client’s data and credentials separate, and remove your access when a project ends.
Rules to check
No U.S. license is needed to do readiness consulting. You cannot issue or sign a SOC 2 report; that is an attestation by a licensed CPA firm under AICPA standards. Do not describe your clients as "SOC 2 certified" by you, and do not promise an outcome. If you are a CPA and your firm also does the audit, independence rules bar it from auditing work it designed.
Data protection: you will see logs, HR records and customer data. Your EU and UK clients will ask you to sign a data processing agreement under the GDPR or the UK GDPR, plus a transfer mechanism such as standard contractual clauses, or the EU-U.S. Data Privacy Framework (with its UK extension) if you join it. The EU General Court upheld the Framework in September 2025; an appeal is pending at the Court of Justice, so keep the clauses as a fallback.
VAT: business-to-business services you supply from the U.S. to VAT-registered EU or UK companies are normally not charged VAT by you; the client accounts for it under the reverse charge. Put their VAT number on the invoice.
Export rules: consulting and policy writing are generally not controlled, but do not work for companies in sanctioned countries or on U.S. restricted lists. See Export controls.
What goes wrong
A client who expects you to do all the work and their engineers to do none; write the client’s duties into the contract. A fixed price that grows because their cloud setup is messier than they said; price the gap assessment first. An auditor who finds an exception in the Type II period because a control was skipped in month three. A client who stops paying once the report is out. The consultants who last use a repeatable kit, put scope in writing and keep good relations with several audit firms.
Questions people ask
How much does SOC 2 consulting cost?
It varies widely with company size and scope. A readiness project for a small software firm often runs from about $10,000 to $25,000, separate from the CPA firm’s audit fee and the compliance software. This page’s example is $15,000 plus a $2,500 monthly retainer.
Can a consultant issue a SOC 2 report?
No. Only a licensed CPA firm can perform the examination and issue a SOC 2 report. A consultant helps the company get ready and supports it during the audit.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 looks at whether controls are designed properly at a point in time. Type 2 tests whether they worked over a period, often three to twelve months. Most U.S. enterprise buyers want Type 2.
Do European companies need SOC 2 or ISO 27001?
ISO 27001 is more common in Europe, but many U.S. customers ask specifically for a SOC 2 report. Companies selling on both sides often end up with both; much of the control work overlaps.
How long does it take to get SOC 2 compliant?
For a small software firm, readiness often takes two to four months, a Type 1 report can follow soon after, and a Type 2 report needs an observation period on top, so about a year for the first Type 2 is common.
Free help
SCORE mentors and Small Business Development Centers help with the business plan, pricing and contracts. The U.S. Commercial Service has offices across Europe and helps U.S. service exporters find partners; your state’s STEP grant may cover part of a trade mission. The AICPA publishes the trust services criteria that SOC 2 audits use, and the U.S. Department of Commerce runs the Data Privacy Framework program site.
The Data Privacy Framework appeal and audit fee levels can change. Points here were checked in November 2026; confirm the transfer mechanism with each client and re-check what audit firms are charging before you quote a full budget.