How to get a startup ready for SOC 2: Type I, Type II, step by step

What are the steps to get a startup ready for SOC 2?

The same nine steps work for a 5-person startup and a 200-person scale-up. The order matters: the customer's real requirement decides the scope, and the scope decides everything after it.

• 1. Get the customer's exact words: which report type, which criteria, which service, by when, and whether ISO/IEC 27001 would also work.
• 2. Build a business case from your own numbers: deals waiting, questionnaire hours, and quotes from auditors and tool vendors.
• 3. Scope the system: the service customers buy plus everything that stores, processes or protects their data; name subservice organisations such as your cloud host.
• 4. Choose criteria: security always, plus availability, confidentiality, processing integrity or privacy where your commitments make them relevant.
• 5. Score your practices 0 to 4 against evidence and rank the gaps by gap x impact.
• 6. Write testable controls with an owner, a frequency and evidence, and approve short policies you will actually follow.
• 7. Keep an evidence register with next due dates and hold a monthly evidence hour.
• 8. Choose a licensed CPA firm after checking peer review and independence; write the system description and management assertion.
• 9. Get the Type I, run the Type II window, log any exception the day you find it, then repeat the cycle each year.

What is the difference between SOC 2 Type I and Type II?

Both are attestation reports issued by an independent CPA firm under the AICPA's standards, examined against the Trust Services Criteria. The criteria in use at November 2026 are the 2017 version with revised points of focus from 2022, covering security, availability, processing integrity, confidentiality and privacy. Security, the common criteria, is always included.

A Type I is a photograph: were the controls suitably designed as of one date? A Type II is a film: did they operate effectively throughout a period? There is no fixed rule for the period's length. The Cloud Security Alliance notes that three to twelve months is what you usually see in practice, and that many first-time reports use a shorter period followed by annual twelve-month reports. Agree yours with your auditor and your customers.

How do you scope a SOC 2 for a startup?

Scope is the service your customers buy plus everything that stores, processes or protects their data, and nothing else without a written reason. Too narrow and your customers' reviewers reject the report; too wide and you spend months building controls around systems that never touch customer data. List every system with an owner and the highest class of data it holds, then mark it in or out. Support desks are often missed: customers attach files to tickets.

The carve-out method is the usual choice for a large cloud host, because the inclusive method needs the host's cooperation. The report excludes the host's controls, describes what you rely on it for and points readers to the host's own SOC 2 report, which you read every year. You also list complementary user entity controls (CUECs): what your customers must do for your controls to work, such as removing their own leavers and protecting their API keys. Write one line on why each optional criteria category is in or out; your auditor and your customers will ask.

Do you need SOC 2, ISO 27001 or Cyber Essentials?

SOC 2 is generally a commercial expectation rather than a legal requirement. The right first report is the one your buyers will accept, so ask them. As a rough pattern, US and US-linked buyers ask for SOC 2; many EU and international buyers prefer an ISO/IEC 27001 certificate, which certifies an information security management system (ISO itself does not certify; certification bodies do); UK public sector and mid-market buyers often ask for Cyber Essentials, the UK government-backed baseline scheme delivered through IASME.

The controls overlap heavily, so build one control set and map it. For UK buyers, note that Cyber Essentials requirements v3.3 apply to assessment accounts created after 27 April 2026, and multi-factor authentication on cloud services is now mandatory where available. In Canada, CPA Canada publishes a SOC 2 guide adapted to Canadian assurance standards (CSAE 3000).

How do you run a SOC 2 gap assessment?

Score each practice from 0 to 4: 0 not in place, 1 ad hoc, 2 defined but not consistent or not evidenced, 3 operating with evidence an auditor could sample, 4 measured and improving. Set a target (usually 3) and an impact from 1 to 3. Then gap = target minus current, and priority = gap x impact. Work the list from the top.

Here is a worked example from a fictional 28-person SaaS company in Austin, Texas, two weeks into its programme. Its average maturity was 0.88 out of 4. Four practices scored the maximum priority of 9 and went to the top of the plan the same afternoon. Ten weeks later the average was 2.67, no gap was rated High and three Medium gaps were owned with dates.

What does a testable SOC 2 control look like?

A control is one sentence an auditor can test: who does what, how often, and what evidence it leaves. 'Access is reviewed regularly' cannot be tested. 'System owners review user access to in-scope systems every quarter and remove what is not needed' can, once you add the evidence: a signed review record and the exported user list.

For controls that run many times, such as leavers, access requests and code changes, the auditor will ask for the full population for the period and sample from it. Make sure each system can export a complete list with dates and times before your window opens. A screenshot of one good example is not enough.

You also write two documents for the report. The system description explains your service, commitments to customers, infrastructure, software, people, procedures and data, the boundaries, subservice organisations and CUECs, and for a Type II any significant changes and incidents in the period. The management assertion is management's signed statement that the description is fair and the controls were suitably designed and, for a Type II, operated effectively. Your auditor will tell you the wording they expect; read every word before you sign.

How do you choose a SOC 2 auditor?

Check the firm's licence with the state board of accountancy, ask for its latest peer review result, and ask how it keeps its independence, especially if a compliance tool vendor referred you. In April 2026 the AICPA's ethics staff published guidance on members' relationships with SOC 2 tool providers, and the AICPA's Journal of Accountancy has reported concerns about reports sold as 'fast and easy'.

Red flags reported there include promises of a report in days, calling the result 'compliance', referral networks of small firms signing very high volumes, templated reports that look the same across clients and heavy reliance on inquiry. Compare at least three firms with weights agreed before you read the proposals.

How long does SOC 2 take and what does it cost?

Time depends on your starting point. The fictional company above spent twelve weeks on readiness before its Type I date, then ran a six-month Type II window, with the report two months after the window closed. Your gap assessment tells you your own distance.

Cost depends on scope, report type, firm and size, and published market figures vary widely, so get quotes. Then set them against the cost of doing nothing: deals delayed or lost (your estimate, as a range) plus the hours spent on security questionnaires. In the worked example, three scenarios for doing nothing in year 1 came to $141,305, $219,305 and $323,305, against $114,865 for doing it, all from that company's own estimates and quotes. The method matters more than the numbers.

What are the most common SOC 2 mistakes?

• Calling a SOC 2 a certificate, or saying 'SOC 2 compliant'. Say which report, which period, which firm.
• Starting a Type II window before controls have run for a few weeks.
• Adopting policy packs that promise things you do not do: every unfollowed rule can become an exception.
• Forgetting that your cloud host is a subservice organisation whose report you must read each year.
• Writing controls with no owner, frequency or evidence.
• Keeping one screenshot instead of a complete population export.
• Choosing an auditor on speed and price alone.
• Hiding an exception instead of disclosing it with a root cause and a fix.
• Pasting questionnaires or confidential material into an unapproved AI tool, or sending AI-drafted answers nobody checked.

How do you keep SOC 2 current each year?

After the first Type II, the programme becomes a calendar: weekly scans, a monthly evidence hour, quarterly access reviews and re-scoring, and yearly policy review, risk assessment, training, penetration test, tabletop exercise, disaster recovery test and vendor reviews.

Watch the criteria too. In October 2026 the AICPA exposed proposed 2027 Trust Services Criteria and description criteria for comment until 15 January 2027. If approved they would apply to engagements beginning on or after 31 December 2027, with early adoption permitted, and they add points of focus on AI governance. Ask your auditor which version your next period uses.

People keep the cycle running. If you want to measure staff security awareness or vendor-review skills, AssessAll offers the Workplace Cybersecurity Awareness Assessment and the Third-Party and Vendor Assurance Assessment. If you own the programme, Jobulary's guide to the WOOP method is a practical way to turn one gap into a goal you reach. The SOC 2 Readiness Kit for Startups from Bodhih Training holds the workbook, forms and templates for every step above.