The short answer
SOC 2 reports can only be issued by an independent CPA firm. Vanta is a compliance platform: it connects to your systems, checks your controls continuously and organizes the evidence your auditor needs. It makes the audit faster and cheaper, but it is not the audit.
What Vanta does
- Connects to your cloud, identity, HR, device and code tools to collect evidence automatically
- Runs automated tests against your controls and flags the ones that fail
- Provides policy templates and tracks employee acceptance of policies and security training
- Tracks vendors, risk assessments and access reviews
- Gives your auditor access to the evidence in one place
What the auditor does
- Agrees the scope of the audit with you
- Tests whether your controls are designed properly, and for a Type 2, whether they operated over the audit period
- Samples evidence, asks follow-up questions and documents exceptions
- Writes and signs the SOC 2 report
Vanta works with a network of audit firms, and many companies choose an auditor that already knows the platform. The auditor must still be independent from the company that prepared you.
Who issues the SOC 2 report?
The CPA firm. When people talk about a "Vanta SOC 2 report," they usually mean the report their auditor issued after using evidence from Vanta, or a report shared through Vanta's Trust Center. Vanta itself does not sign your report.
The work Vanta cannot do for you
This is where most SOC 2 projects stall. Someone still has to:
- Decide the scope and which Trust Services Criteria apply
- Adapt the policy templates to how your company actually works and get them approved
- Fix failing tests, such as missing MFA, unencrypted devices or old accounts that were never removed
- Run quarterly access reviews and vendor reviews, and keep evidence of them
- Make sure onboarding and offboarding follow the written process every time
- Answer the auditor's requests during fieldwork
How long it takes with Vanta
Plan on about 3 to 6 months of preparation, then a 3-month audit period that Vanta monitors, with the audit at the end. Companies that start with clean systems and an owner for the project finish at the faster end.
We set up Vanta, write and roll out the policies, close the gaps and manage the audit with your CPA firm. See Vanta implementation and SOC 2 readiness.