SOC 2 Without the Panic: A Founder's 90-Day Roadmap

What auditors actually check, what you can automate, and where most startups burn time for nothing.

SOC 2 is an audit of whether you do what you say you do. Most of the panic comes from teams trying to invent policy and evidence simultaneously, under deadline.

Days one through thirty are scoping. Decide which trust criteria apply — many companies need only Security — and draw the system boundary. Everything outside that boundary is not your problem, and being precise here removes a surprising amount of work.

Days thirty-one through sixty are controls and automation. Access reviews, change management, and vulnerability handling are where evidence accumulates continuously. Automate the collection now, because retroactively reconstructing three months of access logs is where teams lose weeks.

Days sixty-one through ninety are the observation window and readiness assessment. Auditors are checking consistency, not perfection. A control that is documented as quarterly and performed quarterly passes; a control documented as continuous and performed occasionally does not.

The most common wasted effort is over-scoping: pursuing all five trust criteria because it sounds more rigorous. It multiplies evidence burden and rarely changes a single customer's purchasing decision.