A US agency guide to SOC 2 and USPTO steps enterprise clients ask for

What to take away

SOC 2 is an attestation report from a licensed CPA firm, not a certificate and not a government license. It covers controls at one point in time (Type I) or across an observation window (Type II).
Security is the only mandatory trust services criterion. Availability, processing integrity, confidentiality and privacy are scoped in only when the client buys them.
The NIST Cybersecurity Framework gives you a control vocabulary auditors already recognize. The same controls answer client security questionnaires later.
USPTO filing runs through the online Trademark Center, which replaced TEAS. A clearance search before filing is what keeps office actions rare.
Price readiness as a fixed fee, pass government and audit fees through at cost, and bill coordination as a service fee. Typical USPTO base fees are $350 to $550 per class as of 2026.

Why enterprise clients ask agencies for SOC 2 and trademarks

Enterprise procurement treats an agency like any other vendor. If you touch customer data, login systems, analytics or production hosting, security review starts before the contract does.

A SOC 2 report answers the vendor security questionnaire in one document. Without it, the deal sits in legal review while the client's security team asks for policies, diagrams and evidence.

Trademark questions arrive from a different direction. A client investing in a rebrand wants the name cleared before you build a site around it. They ask you to coordinate filing because you already hold the brand assets.

Both requests are commercial. A stalled security review delays revenue, and an unregistered name invites a cease and desist letter after launch.

Agencies that answer both keep the account. Agencies that deflect watch the client hire a larger firm that already has the paperwork. Add both to your profitable web design agency services list and price them like any other deliverable.

SOC 2 and the AICPA framework explained for agency owners

SOC 2 stands for System and Organization Controls 2. The AICPA framework defines five trust services criteria: security, availability, processing integrity, confidentiality and privacy.

SOC 2 Type I vs Type II

Type I

Coverage: Design only
Timing: Single point
Buyer demand: Reasonable first step
Evidence: Point-in-time

Type II

Coverage: Design + operating
Timing: 3-12 months
Buyer demand: Increasingly required
Evidence: Runs for months

Security is mandatory. The other four depend on what the client buys. Most web agencies scope security plus availability and confidentiality.

The output is an attestation report from a licensed CPA firm. It states that an independent auditor examined your controls against the criteria. It is not a certificate and not a government license.

Type I covers design at a single point in time. Type II covers design and operating effectiveness over a period, usually three to twelve months.

Enterprise buyers increasingly ask for Type II. A Type I is a reasonable first step, but plan the Type II window early because evidence collection runs for months.

The report is confidential and shared under NDA. Clients do not publish it, and neither should you.

CPA firms that perform SOC 2 examinations include A-LIGN, Coalfire, Schellman, BDO USA and Grant Thornton. Deloitte, EY, PwC and KPMG also have SOC practices for larger engagements. A-LIGN and Coalfire publish readiness resources. Schellman is a licensed CPA firm.

The five trust services criteria in plain terms

Five trust services criteria

Criterion	What it covers	Typical agency relevance
Security	Protection against unauthorized access	Always in scope
Availability	System uptime and performance	In scope for hosted sites and apps
Processing integrity	Complete, valid, accurate processing	In scope for ecommerce and forms
Confidentiality	Protection of confidential information	In scope for client data handling
Privacy	Personal information collection and use	In scope when you touch personal data

Mapping NIST controls to SOC 2 readiness

The NIST Cybersecurity Framework is a voluntary set of outcomes organized around identify, protect, detect, respond and recover. It is not a checklist, but it gives you a control vocabulary the auditor recognizes.

NIST to SOC 2 readiness path

Start with trust services criteria
Map NIST outcomes to criteria
Build asset inventory
Write auditor-requested policies
Collect screenshots, tickets, logs

Mapping runs one direction: start with the trust services criteria, then show which NIST outcomes satisfy them. Auditors accept the mapping when it is documented and tested.

The practical benefit is reuse. Controls built for SOC 2 readiness also support client security questionnaires, cyber insurance applications and government contracting programs.

Start with an asset inventory. You cannot protect systems you have not listed. Include hosting accounts, repositories, laptops, SaaS tools and third-party APIs.

Then write the policies the auditor will request: access control, change management, incident response, vendor management, risk assessment and business continuity.

Finally, collect evidence. Screenshots, tickets, logs and signed acknowledgments turn policy into proof. Evidence is where most agencies underestimate the workload.

A readiness mapping table

Readiness mapping table

NIST function	SOC 2 criterion	Evidence an agency can produce
Govern	Security, risk assessment	Roles, policies, supplier register
Identify	Security, risk assessment	Asset inventory, risk register
Protect	Security, confidentiality	Access reviews, encryption records
Detect	Security, availability	Monitoring alerts, log samples
Respond	Security, availability	Incident tickets, postmortems
Recover	Availability	Backup tests, restore logs

Use the Cybersecurity Framework | NIST as your reference when you build that map. It is free, public and written for organizations without a dedicated compliance team.

Scoping a SOC 2 readiness engagement and pricing it

Scope decides price more than anything else. Define the system boundary first: which services, which infrastructure, which people.

A narrow boundary around one hosted product is cheaper than an agency-wide audit. Enterprise clients usually accept a defined boundary if you explain what sits inside it.

Readiness work typically takes eight to sixteen weeks for a small agency. The Type II observation period then runs for three to twelve months.

Price in three parts: a fixed readiness fee, a pass-through audit fee paid to the CPA firm, and an annual maintenance retainer for evidence collection and policy updates.

Do not bundle readiness into a website project. It is a separate engagement with its own statement of work, and it belongs on the service menu as its own line.

Typical fees for a small agency: readiness assessment $15,000 to $40,000. A Type I audit fee commonly runs $8,000 to $25,000. A Type II audit fee commonly runs $20,000 to $60,000.

Annual maintenance retainers typically run $1,000 to $5,000 per month. These are typical ranges. Scope, observation window and auditor drive the number.

Numbered steps for scoping

Scoping a readiness engagement

Interview client security reviewer
Define system boundary in writing
Run gap assessment, score by risk
Build remediation plan with owners
Select CPA firm, start evidence

Define the system boundaryname the services, infrastructure and people in scope.
Run a gap assessment against the five trust services criteria.
Remediate gapspolicies, access reviews, change tickets, backups and vendor reviews.
Collect evidence by criterion and store it in one shared folder.
Engage the CPA firm and schedule the observation window.

Readiness checklist

System boundary documented and approved by the client
Asset inventory complete for in-scope systems
Access control policy written and enforced
Change management process with tickets and approvals
Incident response plan tested at least once
Vendor risk reviews completed for critical suppliers
Evidence folder organized by trust services criterion
CPA firm engaged and observation window scheduled

Put the scope, fees and responsibilities into your proposal template so the client sees what readiness does and does not include.

USPTO trademark basics for agency and client brand names

What USPTO does and does not register

USPTO registers

Brands: Trademarks
Web: Goods/services marks
Entities: Commerce use
Where: Federal register

Not USPTO

Brands: Business names
Web: Domain names
Entities: LLC formations
Where: State registries

A trademark protects the brand a client uses in commerce. The strongest applications follow actual use, not intent alone.

Before filing, run a clearance search. Check the USPTO database, common law use, domain availability and social handles. A clearance search reduces the chance of an office action or an opposition.

Agencies usually handle three trademark tasks: coordinating the clearance search, preparing the filing, and reporting status to the client. A licensed attorney should review legal questions.

The registration process is slow. Examination, publication and registration can take many months. The timeline depends on the class and any objections raised.

USPTO fees are per class. As of 2026, base application fees typically run $350 to $550 per class. Attorney fees for a simple application typically run $1,000 to $3,000.

Clearance searches typically run $400 to $1,500. Agency coordination fees typically run $500 to $2,500 per mark. These are typical ranges. The number of classes, the goods and services description, and any office action drive the total.

Follow the registration steps outlined in Trademark basics | USPTO when you build your internal process for client brand names.

What agencies should not do

Do not promise registration. Do not give legal advice. Do not file without the client's written authorization and a clear scope.

Do not ignore use requirements. A registration can be canceled if the mark is not used in commerce as claimed.

Filing a trademark online and tracking application status

Filing happens through the USPTO's online Trademark Center, which replaced the older TEAS system. The TEAS-era filing options differed in cost and completeness. Today's choices follow the same split: pre-approved goods and services cost less than free-form descriptions.

Trademark application timeline

Filing
Submit via TEAS, save serial number
Examination
Examiner reviews, may issue office action
Publication
Mark publishes for opposition window
Registration
Follows if nobody objects

A complete filing with all required information costs more upfront but usually saves time later. An incomplete filing costs less but invites office actions.

Use the Apply online | USPTO page to see the current filing options and fees before you quote a client.

After filing, the application enters examination. An examiner reviews it, and may issue an office action. A response is usually due within three months, and a six-month extension is available for a fee.

If approved, the mark publishes in the Official Gazette for opposition. Third parties get 30 days to object, and that window can be extended. If nobody objects, registration follows.

Status checks should be routine. Check the application at least monthly and report changes to the client in writing.

Use the Checking the status of a trademark application or registration | USPTO page to pull the current status and documents for any client matter. The USPTO's Trademark Status and Document Retrieval (TSDR) database holds the file wrapper.

Trademark filing steps

Confirm the exact mark, the goods or services, and the filing basis with the client. Common bases are use in commerce under Section 1(a) and intent to use under Section 1(b).
Run a clearance search and document the results. Search the USPTO trademark search system, state registries, common law sources, domains and social handles.
Choose the filing option that matches the client's budget and risk tolerance. Pre-approved goods and services are cheaper. Free-form text costs more and can trigger a surcharge.
Submit the application through the USPTO Trademark Center and save the serial number and filing receipt.
Monitor examination in TSDR. Respond to office actions within the deadline, and track publication in the Official Gazette.
Report status to the client monthly until registration or abandonment. For intent-to-use filings, calendar the Statement of Use deadline.
Maintain the registration. File a Section 8 declaration between years five and six. Renew under Section 9 every ten years.

Status reporting checklist

Serial number recorded in the client file
Filing receipt saved
Examiner correspondence logged
Office action deadlines on the calendar
Publication date confirmed
Registration certificate delivered to the client
Renewal and maintenance deadlines noted
Statement of Use deadline tracked for intent-to-use filings

Review the full Trademark process | USPTO so your internal steps match the official sequence and deadlines.

Building SOC 2 and trademark support into a service line

Treat both as recurring services, not favors. Compliance renews, trademarks need maintenance, and clients change systems every year.

Building the recurring service line

Start narrowone boundary, one mark
Document process once, reuse templates
Train one compliance delivery owner
Price fixed readiness plus filing fees
Report monthly with dates and serials

Start with a narrow offer. SOC 2 readiness for a defined system boundary, and trademark filing coordination for one mark per brand. Expand once the process is repeatable.

Document your process once and reuse it. Templates for policies, evidence folders, status reports and client questionnaires cut delivery time on every engagement.

Train one person to own compliance delivery. A single owner keeps evidence current and prevents the scramble before an audit window closes.

Price with a fixed fee for readiness and a service fee plus government fees for filings. Pass government fees through at cost so the client sees the real number.

Put the boundaries in writing. Use contract terms that prevent disputes to state that you coordinate compliance work but do not provide legal advice or guarantee registration.

Report progress the way enterprise buyers expect. Monthly status notes with dates, serial numbers and next steps become the reports clients trust during procurement reviews.

Build the offer into your service menu in 2027 alongside hosting, care plans and analytics, so clients see it as a standard option rather than a special request.

A simple pricing model

Component	Basis	Typical range	Who pays
Readiness assessment	Fixed fee	$15,000 to $40,000 for a small agency	Client
Remediation support	Hourly or fixed	$150 to $300 per hour, or fixed quote	Client
Audit fee	Pass-through	$8,000 to $25,000 Type I; $20,000 to $60,000 Type II	Client, paid to CPA firm
Annual maintenance	Retainer	$1,000 to $5,000 per month	Client
Trademark filing coordination	Fixed service fee	$500 to $2,500 per mark	Client
Government filing fees	Pass-through at cost	$350 to $550 per class, as of 2026	Client
Trademark attorney review	Hourly or fixed	$1,000 to $3,000 for a simple application	Client, paid to attorney
Clearance search	Fixed fee	$400 to $1,500 per mark	Client

Common pitfalls

Scoping the whole agency when one product would satisfy the client
Collecting evidence only in the final week before the audit
Filing a trademark without a clearance search
Missing an office action response deadline
Promising registration or a clean audit opinion
Leaving renewal deadlines unassigned
Missing the Statement of Use deadline for intent-to-use filings

Common questions

What is SOC 2 in simple terms?

It is an independent audit report about an organization's controls, built on the AICPA trust services criteria. Enterprise clients use it to approve vendors that handle their data. A licensed CPA firm issues the report, and security is the only mandatory criterion.

Do we need SOC 2 if we only build websites?

Only if clients require it or you host and process their data. Many agencies start with a readiness assessment and defer the audit until a deal depends on it. A Type I report can satisfy a first review; a Type II takes three to twelve months of evidence.

How long does SOC 2 readiness take?

For a small agency, readiness usually takes eight to sixteen weeks, followed by an observation period of three to twelve months for a Type II report. A Type I report covers one point in time and needs no observation window.

Can we file a trademark ourselves?

You can prepare and submit the filing through the USPTO Trademark Center, but a licensed attorney should handle legal questions and office action responses. Keep the scope written and avoid giving legal advice. Expect $350 to $550 per class in USPTO base fees as of 2026.

How often should we check trademark application status?

At least monthly through the USPTO's TSDR system. Deadlines for office action responses are short. A missed deadline can abandon the application, and publication opposition windows are only 30 days unless extended.

How should we price compliance work?

Use a fixed fee for readiness, a pass-through for audit and government fees, and a retainer for annual maintenance. Typical small-agency readiness runs $15,000 to $40,000. USPTO base fees run $350 to $550 per class as of 2026. Do not bundle it into website project pricing.