SOC 2 for startups: the 90-day readiness path

First, set expectations

SOC 2 isn't a certification you pass once; it's an independent auditor's report on whether your controls are designed well (Type I) and operate over time (Type II). "Readiness" — the part you control — is getting your controls in place and your evidence organized so the audit goes smoothly. Most startups can reach readiness in about 90 days of focused effort; the Type II observation window then runs for a few months after.

Weeks 1–2: Scope, baseline, and a readiness assessment

• Define the systems, products, and data in scope. Write a one-page system description.
• Run a readiness assessment to see your current gaps against the criteria — this is your map for the next 11 weeks.
• Assign an owner for the effort (even if it's the CTO) and a shared place to keep evidence.

Weeks 3–5: Policies and the control environment

• Draft the core policies: information security, access control, change management, incident response, vendor management, and business continuity. Keep them real and short — auditors can tell when a policy is theater.
• Establish roles and responsibilities and a basic risk-assessment process.
• Get policies approved and communicated. Approval records are evidence.

Weeks 4–8: Technical controls (run in parallel)

• Access: enforce SSO + MFA everywhere, least-privilege roles, and a documented joiner/mover/leaver process. Do an access review and keep the record.
• Change management: require pull-request reviews, branch protection, and approvals; capture tickets as evidence.
• Logging & monitoring: centralize logs, set a few alerts on suspicious activity, and define who responds.
• Data protection: encryption in transit and at rest, a data inventory, and retention/disposal practices.
• Vendors: list your subprocessors and collect their SOC 2 / security reports.

Weeks 8–10: Evidence, evidence, evidence

This is where teams stall. For every control, you need proof it operates: configuration exports, screenshots with visible dates, review records, tickets, and logs — named and organized so an auditor can find them. The single biggest time-saver is knowing, for each control, exactly what artifact to collect and where it lives, instead of guessing.

Weeks 11–12: Pick an auditor and dry-run

• Choose a reputable CPA firm for the SOC 2 attestation (the software doesn't issue the report — an auditor does).
• Do an internal dry run: walk each control and confirm the evidence is there and dated.
• Decide Type I now vs. Type II after an observation window, based on what your buyer needs.

The time sinks to avoid

• Over-scoping. Adding criteria your customers don't ask for multiplies the work.
• Policy theater. Long, copied policies you don't follow fail at audit. Write what you actually do.
• Evidence chaos. Scattered screenshots with no dates are the #1 cause of delay. Organize as you go.
• Redoing work per framework. Most SOC 2 controls also satisfy ISO 27001, NIST, and others — capture once and reuse.

How Standpoint shortcuts this

Standpoint gives you the SOC 2 readiness assessment, a prioritized gap list, and — for every control — the exact evidence to collect (who, what, where, step-by-step how, and the acceptance bar), tailored to your cloud. Because it crosswalks to ISO 27001, NIST and more, the same work moves your other frameworks too. Start free.

SOC 2 and the Trust Services Criteria are governed by the AICPA. This guide is Standpoint's own practical summary; the attestation is performed by an independent CPA firm.