SOC 2 readiness starter guide

It usually starts with an email from a larger customer: “Can you send us your SOC 2 report?” If you don’t have one, this guide explains what’s involved and where to start. It’s written for founders and engineering leads, not compliance specialists.

This is a practical overview, not legal or audit advice. Your auditor makes the final call on what’s required.

What SOC 2 is

SOC 2 is an independent report on how well a company protects the data it handles for customers. It’s produced by a licensed CPA firm after reviewing your controls: the policies, processes and technical settings that keep systems secure.

The report is organised around five Trust Services Criteria:

• Security. Always required. Protecting systems against unauthorised access.
• Availability. Keeping systems running as promised.
• Processing integrity. Making sure systems process data completely and correctly.
• Confidentiality. Protecting information marked as confidential.
• Privacy. Handling personal information properly.

Most first-time reports cover Security only, sometimes with Availability or Confidentiality added. Pick the criteria your customers actually care about.

Type I and Type II

• Type I checks that your controls are designed properly at a single point in time.
• Type II checks that they actually worked over a period, typically three to twelve months.

Customers usually want Type II. Many companies get a Type I first, because it can be done sooner, and then start the Type II observation period straight after.

What auditors look for

Auditors want evidence, not promises. For each control, they’ll ask you to show that it exists and, for Type II, that it was followed throughout the period. Evidence might be a screenshot of a setting, an export of access reviews, a ticket showing a change was approved, or a log of completed training.

The practical lesson: if you do something but don’t record it, it doesn’t count.

Engineering controls to put in place first

If you’re starting from scratch, these are the controls we’d tackle first. They’re the ones auditors check most and the ones that take longest to show a track record.

Access

1. Single sign-on for the main tools, with multi-factor authentication required.
2. Access granted by role, with a documented approval for each new access.
3. A written offboarding process, with access removed on the person’s last day.
4. A quarterly access review, recorded each time.

Change management

5. All code changes go through pull requests with at least one reviewer.
6. Nobody can push straight to the main branch or deploy to production without going through the pipeline.
7. Infrastructure is managed as code, so changes are reviewed the same way.

Monitoring and response

8. Audit logging switched on in your cloud accounts and identity provider.
9. Alerts for important security events, such as root account use or changes to access policies.
10. A written incident response plan, and at least one practice run per year.

Data protection

11. Encryption at rest and in transit for customer data.
12. Backups that are tested by actually restoring them.
13. A list of the vendors that handle customer data, with a yearly review of each.

People

14. Background checks for new hires, where local law allows.
15. Security awareness training when people join, then once a year.
16. Signed acceptance of your security policies.

The policies you’ll need

Expect to write around a dozen short policies, including information security, access control, change management, incident response, business continuity, vendor management and data retention. Keep them short and true. A two-page policy your team follows is far better than a twenty-page template nobody reads.

A realistic timeline

• Months 1 to 2: choose your criteria, find gaps, write policies, set up the core controls.
• Month 3: Type I audit, if you want one.
• Months 3 to 9: Type II observation period, with controls running and evidence collected.
• After that: Type II audit and report, then repeat every year.

Compliance automation tools can collect much of the evidence for you by connecting to your cloud, code and HR systems. They don’t replace the work, but they make it far less tedious.

Where to begin this week

Turn on multi-factor authentication everywhere, protect your main branch, switch on cloud audit logging and do a first access review. Those four steps start your track record immediately, and they make you more secure whether or not you ever finish the audit.