You keep the durable assets: policies, control design, platform configuration, the auditor relationship, and everything your team learned the first time through. What you lose is continuity. A Type 2 attests to a continuous observation period, and months with no monitoring, no reviews, and no evidence can never be covered by any future report — the next window starts only when the program does.
The quiet costs stack up off the books. Integrations disconnect and stop collecting the history you’ll want later; access sprawls with no one reviewing it; the person who ran the controls moves on; and the eventual restart begins with exactly the evidence scramble described in behind on audit evidence — while the gap after your last report’s period keeps widening in front of buyers.
The cheaper middle path is idling, not stopping: keep monitoring connected and run only the dated, recurring controls — access reviews, vendor reviews, offboarding, training. Skip the audit cycle if no customer needs a fresh report this year. Re-engaging an auditor from a maintained program is a scheduling exercise; from a cold one it’s a rebuild. Holding that floor takes a few hours a month, and it’s work a managed compliance team can carry without your attention.
Connected monitoring plus the dated recurring controls — quarterly access reviews above all. Those timestamps are the one thing money can’t recreate later, and they’re what lets a future auditor treat your history as continuous.
The platform holds your evidence history and integrations, so disconnecting it is most of what makes restarts expensive. Downgrade the tier if you can; if you must cancel, export the evidence archive before anything goes dark.
