Get your startup ready for its first SOC 2 report, from scope to the yearly cycle
For founders, CTOs and operations leads at 5 to 200 person SaaS and service companies: a working 22-sheet workbook, 5 fillable forms, brand-ready templates and a step-by-step e-book that follows one startup from the customer's email to its Type II report.
- A 22-sheet readiness workbook: 0-4 self-assessment, ranked gap plan, control matrix, evidence register and a dashboard with five charts
- 20 policy starters, a system description and assertion starter, and a leadership memo with readiness and assertion sign-off
- 5 fillable forms for scoping, auditor selection, access and change records, incidents and vendor reviews
- 32 messages with a trust page and answer bank, 27 AI prompts, a team briefing and a 14-question LMS-ready knowledge check
The SOC 2 Readiness Kit for Startups · Bodhih Pro Kits · 312 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do you get a startup ready for SOC 2?
Find out what your customer needs, scope the service and criteria, score your practices honestly, write testable controls with owners and evidence, approve policies you follow, collect evidence monthly and choose a licensed CPA firm on quality and independence. The SOC 2 Readiness Kit for Startups from Bodhih Training gives you the files for each step.
Want the full free guide first? Read How to get a startup ready for SOC 2: Type I, Type II, step by step.
You already feel the problem. Here is what it is costing you.
A deal is waiting on a report you do not have
The contract is agreed except for one line asking for SOC 2. You need to know quickly what the customer really needs and what it will take.
Nobody knows where you stand
Some things are done, some are done sometimes, and none of it is written down. You need an honest baseline and a ranked list, not a 400-row spreadsheet.
Policy packs that promise things you do not do
Downloaded templates describe biometric locks and data centres you do not have. Every unfollowed rule becomes an exception.
Questionnaires eat your week
Each customer sends a different spreadsheet. You answer the same questions from memory, slightly differently each time.
Picture the next few weeks with the kit open beside you.
Imagine the Friday before your Type I date. You open the Dashboard and read, in numbers and colours, how many gaps remain, which controls are operating and which evidence items are due on Monday. You know exactly whose desk to walk to.
As you print the readiness sign-off, you notice something: the questions your auditor will ask already have answers. Who owns each control. How often it runs. Where the evidence lives. Which vendor reports you have read and which CUECs you run.
When a prospect's questionnaire arrives the following month, open the answer bank, offer the report under NDA, and send back a short set of checked answers instead of losing a week to it.
Whether you start with the Business Case Calculator tonight or the Self-assessment at Monday's meeting, the Start-here map tells you which file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The SOC 2 Readiness Kit for Startups (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: SOC 2 readiness map
The job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan, the 'Brand it in five minutes' box and what is in the kit.
SOC 2 Readiness Workbook
22-sheet workbook: Settings, scope, 0-4 self-assessment with a ranked gap-to-action plan, control matrix, evidence register with due-date traffic lights, policies, risks, vendors, exceptions, questionnaires, RACI, roadmap, crosswalk, official sources, glossary, What changed log and a dashboard with five charts.
SOC 2 Business Case Calculator
Five-sheet calculator: your estimates and quotes, year 1 and year 2 costs, cost of doing nothing in three scenarios and a dashboard with three charts.
SOC 2 scoping and readiness interview
Four-page fillable worksheet: the customer ask and report type, the system boundary and subservice organisations, criteria and dates, and a 24-question readiness interview that feeds the Self-assessment sheet.
Auditor selection scorecard
Three-page fillable scorecard for comparing CPA firms: licence, peer review and independence checks, a weighted score for up to three firms, interview questions, reference calls and the decision record.
Access and change control records
Four fillable records an auditor will sample: quarterly user access review, joiner-mover-leaver record, change request and emergency change record.
Security incident report and post-incident review
Four-page fillable record: first report and triage, timeline and actions, the notification decision record, and the post-incident review with lessons and owners.
Vendor security review form
Three-page fillable review: vendor and data, reading the vendor's SOC 2 report or ISO/IEC 27001 certificate (type, period, opinion, exceptions, CUECs, subservice organisations), and the decision with conditions.
SOC 2 policy starter library
Twenty brand-ready policy starters (security, acceptable use, access, change, secure development, incident response, vendors, backup, continuity, HR security, classification, retention, encryption, logging, risk, vulnerabilities, assets, remote working, authentication, confidentiality) with owners, rules and the evidence each one creates.
System description and management assertion starter
Brand-ready starter for the two documents you write for the report: the system description in nine sections (services, commitments, components, boundaries, carve-out, CUECs, control environment, changes and incidents) and an adaptable management assertion.
Leadership sign-off and decision memo
Brand-ready three-part template: the one-page decision memo with options and costs, the readiness sign-off before the Type I as-of date, and the management assertion sign-off for each report.
SOC 2 message library, trust page and answer bank
32 brand-ready messages for customers, auditors, staff, vendors and leadership, a trust page starter and a 20-answer security questionnaire bank.
Worked example pack: Pinecrest Data
The kit's main files completed for one composite 28-person SaaS company in Austin: decision and business case, scope, self-assessment, gap plan, controls and evidence, an access review, a vendor review, the auditor choice, two exceptions with management responses and questionnaire hours.
AI prompt pack for SOC 2 readiness
27 prompts with placeholders grouped by step (decide and scope, assess, build, evidence, audit, sell, yearly cycle), each with what to paste in, what to check, and four human-review rules.
Team briefing session plan and answer key
A 45-minute briefing plan to run with your team, facilitator notes, LMS import notes, the printable answer key for the 14-question knowledge check and an attendance record.
SOC 2 knowledge check (LMS-ready)
14 scenario questions with four options, the correct letter and an explanation; imports into Bodhih LMS or any LMS that accepts CSV quizzes.
Numbers that matter: SOC 2 KPI card
13 numbers with plain-words definition, formula, where each lives in the workbook and what to do when it moves, plus a flow mini-infographic.
SOC 2 decision card and mistakes to avoid
Eleven 'if this, do that' decisions with the file to open, the path in one line and fifteen mistakes with what to do instead.
Evidence calendar and audit window card
Weekly, monthly, quarterly and yearly evidence tasks, the Type I and Type II timeline, the monthly window checklist and population and sampling in plain words.
SOC 2 and security rules by market (November 2026)
Dated sheet: the SOC 2 criteria position including the proposed 2027 update, and a crosswalk of what buyers ask for and which laws and schemes apply in the US, Canada, UK, EU, Australia, New Zealand and elsewhere.
SOC 2 12-month readiness calendar
29 calendar events: twelve weekly readiness meetings, the Type I as-of date, the Type II window, monthly evidence hours, quarterly reviews, tests, fieldwork and next year's planning.
SOC 2 task board (CSV import)
41 tasks with phase, owner role, start and due week, labels and the kit file to use; imports into Trello, Asana, Notion, Planner or Jira.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 71 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira, Bodhih LMS and most LMS quiz importers
- Best for
- SaaS and service startups of 5 to 200 people preparing a first SOC 2 Type I and Type II
Why customers ask for SOC 2, and what it is
Why customers ask, Type I and Type II, the criteria in plain words, whether SOC 2 is the right first report, and the business case.
Scope: the system, the criteria and the period
The system boundary, subservice organisations and the carve-out, CUECs, choosing criteria and dates.
The readiness gap assessment
A 0-4 maturity self-assessment of 24 practices and a gap-to-action plan ranked by gap x impact.
Building the control matrix
Writing testable controls with owner, frequency and evidence, the RACI and the weekly trend.
Policies people actually follow
Twenty policy starters, approval and acknowledgement, AI tools in acceptable use, and the team briefing.
Access, change and the everyday controls
SSO and MFA, joiners and leavers, access reviews, change management, monitoring and recovery.
People, vendors and incidents
HR security, reading vendors' SOC 2 reports and CUECs, incident response and the notification decision.
Evidence, the calendar and the audit window
The evidence register, populations and samples, the readiness sign-off and handling exceptions.
Choosing an auditor and getting through the examination
Choosing a CPA firm on licence, peer review and independence; tools; the system description and assertion.
Questionnaires, the trust page and the yearly cycle
Questionnaires and the answer bank, the trust page, other markets, AI with human review and the yearly cycle.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-SOC-2-Readiness-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan and the 'Brand it in five minutes' box
Workbooks
- SOC-2-Readiness-Workbook.xlsx: 22 sheets including Settings, scope, 0-4 self-assessment, ranked gap plan, control matrix, evidence register, policies, risks, vendors, exceptions, questionnaires, RACI, roadmap, crosswalk, official sources, glossary, What changed and a dashboard with five charts and traffic lights
- SOC-2-Business-Case-Calculator.xlsx: 5 sheets comparing the cost of doing nothing in three scenarios with the cost of doing it in years 1 and 2
Fillable forms
- SOC-2-Scoping-and-Readiness-Interview.pdf: the customer ask, the system boundary, criteria and dates, and a 24-question readiness interview
- Auditor-Selection-Scorecard.pdf: must-pass checks, weighted scores for three firms, interview questions and the decision
- Access-and-Change-Control-Records.pdf: quarterly access review, joiner-mover-leaver, change request and emergency change records
- Security-Incident-Report-and-Post-Incident-Review.pdf: first report, timeline, notification decision and blameless review
- Vendor-Security-Review-Form.pdf: reading a vendor's SOC 2 report or ISO/IEC 27001 certificate, CUECs and the decision
Word templates
- SOC-2-Policy-Starter-Library.docx: 20 brand-ready policy starters with owners and evidence
- System-Description-and-Management-Assertion-Starter.docx: nine sections and adaptable assertion wording
- Leadership-Sign-Off-and-Decision-Memo.docx: decision memo, readiness sign-off and assertion sign-off
- SOC-2-Message-Library.docx: 32 messages, a trust page starter and a 20-answer questionnaire bank
- Worked-Example-Pack-Pinecrest-Data.docx: the main files completed for one composite 28-person SaaS company
- AI-Prompt-Pack-for-SOC-2-Readiness.docx: 27 prompts with what to paste in, what to check and four human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute session plan, facilitator notes and the printable answer key
Team training (LMS-ready)
- SOC-2-Knowledge-Check.csv: 14 scenario questions in question, option_a to option_d, correct, explanation format
Cheat sheets
- Numbers-That-Matter-SOC-2.pdf: 13 numbers with formulas and what to do when they move
- SOC-2-Decision-and-Mistakes-Cards.pdf: eleven 'if this, do that' decisions and 15 mistakes to avoid
- Evidence-Calendar-and-Audit-Window-Card.pdf: weekly to yearly evidence tasks and the Type I and Type II timeline
- SOC-2-and-Security-Rules-by-Market-November-2026.pdf: dated crosswalk for the US, Canada, UK, EU, Australia, New Zealand and elsewhere
Calendar and import
- SOC-2-12-Month-Readiness-Calendar.ics: 29 calendar events
- SOC-2-Task-Board.csv: 41 tasks for Trello, Asana, Notion, Planner or Jira
E-book
- The SOC 2 Readiness Kit for Startups e-book: about 9,900 words, 10 chapters and 24 figures
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Find out exactly what a customer needs and write a business case with your own numbers
- Set a defensible scope with subservice organisations and CUECs
- Score 24 practices honestly and work a gap plan ranked by formula
- Write testable controls and keep an evidence register that shows what is due
- Approve policies your team follows and brief the team with a knowledge check
- Compare CPA firms on licence, peer review and independence
- Handle exceptions with facts, root cause and a management response
- Answer questionnaires from a dated, checked answer bank and run the yearly cycle
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff
Take the assessment →AssessAll assessmentThird-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams
Take the assessment →AssessAll assessmentData Governance & Data Quality Stewardship Judgment
Take the assessment →JobularySet goals you actually reach with the WOOP method (Jobulary)
Make it a growth plan →A taste of Chapter 6
Within four weeks every tool that supported SSO was behind it, and two that did not were on an exceptions list with a plan. The first quarterly access review of the production database, on 19 March, covered nine users and made two changes: a contractor's read access was removed and an engineer moved from admin to read-only. Jordan saved the user list exported at 09:12 with the signed form. The A3 gap, least privilege for production, stayed Medium in week 12 because two engineers still had standing database admin rights. Marco's next action was just-in-time access, due 23 April. The O2 gap stayed Medium because three high-severity findings were past their fix deadline; they were the first thing on his list.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Where you stand | A checklist of yes and no | A 0-4 self-assessment with level descriptors, gap x impact priority and a ranked gap plan |
| Controls | A generic control list to copy | A control matrix with owner, frequency, evidence and checks that flag gaps; tools and consultants still need your input here |
| Policies | Long packs that promise more than you do | 20 short starters with placeholders, owners and the evidence each creates |
| Evidence | A folder of screenshots | An evidence register with next due dates, status traffic lights and a monthly rhythm |
| Auditor choice | Pick the fastest or cheapest | A scorecard with licence, peer review and independence checks first |
| Compared with a consultant or software | A consultant brings judgement and hands-on time; software automates evidence collection | The method, the files and the decisions in one place; works alongside either, or on its own |
Made for you if…
- Founders and CTOs of SaaS and service startups whose first enterprise customer has asked for a SOC 2 report
- Heads of engineering, security or operations who have just been told 'you own SOC 2 now'
- Startups selling to US buyers from Canada, the UK, the EU, Australia or New Zealand
- Companies answering more security questionnaires than they can handle
- Teams already using a compliance automation tool who want a method behind it
- Consultants and fractional CISOs who want a clear, brandable starting kit for a client (within the licence)
Probably not for you if…
- Anyone wanting an audit, attestation or certificate: only a licensed CPA firm can examine you and issue a SOC 2 report
- Anyone looking for legal advice: laws and contracts need your counsel
- Large enterprises with an established internal audit and GRC function
- Companies needing SOC 1 (financial reporting controls) rather than SOC 2
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your SOC 2 programme, in one place
Open the Start-here map and give it one hour. Whether you begin with the Business Case Calculator tonight or the Self-assessment at your next team meeting, you will know what to do next and which file to open.
Personal licence for the buyer's own use, including use within your own company and with its staff. Please don't share or resell the files. Team, company and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The ISO 27001 Implementation Toolkit
Implement an information security management system aligned to ISO/IEC 27001.
The Digital Accessibility Compliance Kit
Make websites, apps, documents and digital products accessible and manage the legal risk.
The Pay Transparency Readiness Kit
Prepare an employer for pay transparency laws and do it well.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The SOC 2 Readiness Kit for Startups: FAQs
Read the free guideAlready bought? Resend my linkWill this kit make my company SOC 2 compliant?
No kit can. A SOC 2 is an attestation report from a licensed CPA firm, not a certificate, and the result depends on your controls and the examination. The kit helps you prepare: scope, gaps, controls, policies, evidence, auditor choice and the yearly cycle. It is not legal advice.
Should we get a SOC 2 Type I or Type II first?
A Type I covers design at one date and can come sooner; a Type II covers operation over a period and is what enterprise buyers typically ask for each year. A common path is a Type I first if their customer agrees. The kit's scoping worksheet and message library help you ask.
How long does it take to get SOC 2 ready?
It depends on where you start and how much time you have. The e-book's sample company took twelve weeks of readiness before its Type I date, then a six-month Type II window. Your self-assessment shows your own gap; the roadmap and calendar turn it into dates.
What does a SOC 2 audit cost?
Fees vary with scope, report type, firm and company size, so the kit does not quote market prices. The Business Case Calculator holds your own quotes and estimates and sets them against the cost of doing nothing. Ask at least three CPA firms.
Do I need SOC 2 if I already have ISO 27001, or the other way round?
It depends on who your buyers are. US buyers ask for SOC 2 most often; many EU and international buyers prefer ISO/IEC 27001. The workbook's Crosswalk sheet maps one control set to both, plus UK Cyber Essentials and others.
Is SOC 2 required by law in the UK, EU or US?
Generally it is a customer and contract expectation rather than a law. Data protection and sector laws still require appropriate security. The dated sheet lists the main rules by market at November 2026; check with your counsel.
Can I do SOC 2 without a consultant?
Many small companies run readiness themselves with a clear method and a good auditor. The kit gives you the method, files and decision rules. If you hire a consultant or use a compliance tool, the kit works alongside them; the auditor must stay independent of both.
Can I use this with my team?
Yes, within your own company under the personal licence: share the files with your staff, run the 45-minute briefing and load the knowledge check into your LMS. Company-wide, multi-entity and consultant licences are available via solutions@bodhih.com.
Does it work in my country?
The method works anywhere. The dated sheet covers the US, Canada, the UK, the EU, Australia and New Zealand, with a short note for India and the Gulf. Laws, schemes and criteria change, so check the official sources listed and your adviser.
Does it work with compliance automation tools?
Yes. Tools collect evidence and track policies; the kit gives you the scope, scoring, control design, auditor checks and decisions the tool does not make. Use the Evidence register to record where each item lives, in the tool or elsewhere.
How can I measure my team's starting point on security judgement?
AssessAll offers the Workplace Cybersecurity Awareness Assessment, the Third-Party and Vendor Assurance Assessment and the Data Governance and Data Quality Stewardship Judgment assessment at assessall.com, useful for staff awareness, vendor review and data handling skills alongside the kit's own knowledge check.
How do I turn this into a development plan for myself?
Pick one goal from your gap plan and plan it with the WOOP method (wish, outcome, obstacle, plan); Jobulary explains it in its guide to setting goals you actually reach.
How much does The SOC 2 Readiness Kit for Startups cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
