It usually happens in the third call with an enterprise prospect: "Can you send us your SOC 2 report?" If the answer is "not yet", the deal often stalls in security review for months.
The good news is that most of SOC 2 is good engineering hygiene, written down and proven. Here's the engineering side of the job, in the order we tackle it with clients.
SOC 2 in two minutes
SOC 2 is an attestation framework from the AICPA. An independent auditor reports on your controls against the Trust Services Criteria:
- Security: always required
- Availability, Confidentiality, Processing Integrity and Privacy: optional, chosen to match your customer commitments
Most startups start with Security, often adding Availability and Confidentiality.
| Type I | Type II | |
|---|---|---|
| Tests | Control design at one point in time | Control operation over 3–12 months |
| Timeline | Weeks after readiness | Readiness plus observation window plus audit |
| Buyers' view | "Good start" | "The real thing" |
The engineering checklist
Identity and access
- SSO for every internal tool (Google Workspace or Microsoft Entra), with MFA enforced, ideally phishing-resistant passkeys
- Least-privilege roles in cloud, database and admin panels
- No shared accounts; production access is named and logged
- Quarterly access reviews, documented
- Offboarding checklist that removes access within 24 hours
Change management
- All code changes through pull requests with review. Branch protection on
main - CI runs tests, lint and security scans before merge
- Deployments are automated and traceable to a commit
- Infrastructure as code (Terraform, Pulumi or similar) where practical
- Emergency changes allowed, but reviewed after the fact and documented
Infrastructure and data
- Encryption in transit (TLS everywhere) and at rest (database, backups and object storage)
- Separate production, staging and development environments, with no production data in dev
- Backups with tested restores, at least once per audit period, with evidence kept
- Network controls: private databases and restricted security groups
Logging and monitoring
- Centralised application and audit logs, with retention defined (often 1 year)
- Alerts for security events: admin role changes, failed-login spikes, unusual data exports
- Uptime and error monitoring with an on-call path
Vulnerability management
- Dependency scanning (Dependabot, Renovate or Snyk) with SLAs for critical fixes
- Container and infrastructure scanning
- An annual penetration test by a third party
Incident response and continuity
- A written incident response plan with roles and communication templates
- A tabletop exercise at least yearly
- A business continuity and disaster recovery plan, with the restore test as evidence
Vendors
- An inventory of subprocessors (cloud, email, analytics and AI providers)
- Their SOC 2 or ISO reports collected annually
- Data processing agreements in place
Tooling that saves months
Compliance automation platforms such as Vanta, Drata and Secureframe connect to your cloud, identity provider and code host, continuously collect evidence and flag gaps. For a small team, they typically halve the effort and make the Type II window far less painful.
A realistic timeline
| Weeks | Milestone |
|---|---|
| 1–2 | Pick the criteria and auditor; connect the automation tool; gap assessment |
| 3–8 | Engineering fixes from the checklist; policies adopted |
| 8–10 | Type I audit |
| 10–22+ | Type II observation window (minimum ~3 months) |
| After window | Type II audit and report |
Bottom line
SOC 2 isn't a document exercise. It's access control, reviewed changes, logging, backups and incident response, done consistently and proven. Start the engineering work before the deal that needs it.
Our maintenance and custom software teams implement SOC 2 engineering controls as fixed-scope sprints. If you're also preparing for a fundraise or acquisition, see our technical due diligence checklist. Talk to us.
Frequently asked questions
What's the difference between SOC 2 Type I and Type II?
Type I assesses whether your controls are designed properly at a single point in time. Type II tests whether they actually operated effectively over an observation period, usually 3–12 months. Enterprises generally want Type II, but a Type I can unblock early deals.
How long does SOC 2 take for a startup?
With a compliance automation tool and focused engineering time, many startups reach Type I readiness in 6–10 weeks. Type II then requires an observation window of at least three months before the audit.
How much does a SOC 2 audit cost?
For a small startup, budget for the auditor fee plus a compliance automation platform. Combined, first-year costs commonly land in the low-to-mid five figures in USD or GBP, before internal time and any security tooling.
Do we need SOC 2 or ISO 27001?
US buyers usually ask for SOC 2; European and global enterprises often accept or prefer ISO 27001. Many controls overlap, so whichever you do first makes the second much cheaper.