SOC 2 readiness in plain English

Most teams approach SOC 2 like a 200-page form they have to fill in. It’s not. SOC 2 is a framework for proving you take security seriously, evaluated by an independent auditor against a fixed set of criteria. The criteria are public. The framework is finite. Done right, the first audit is a 6-month project — not the year-long ordeal it gets characterized as.

Here’s what SOC 2 actually is, in plain English.

The five Trust Service Criteria

SOC 2 evaluates you against up to five “Trust Service Criteria”:

• Security (mandatory). Access controls, encryption, vulnerability management. This is the only one you HAVE to include. Most B2B SaaS get SOC 2 with only Security in scope, especially for the first audit.
• Availability (optional). Uptime SLAs, incident response, business continuity planning. Add this if you sell to customers who care about uptime commitments.
• Confidentiality (optional). Data classification, NDAs, secure destruction. Add this if you handle customer data marked as confidential.
• Privacy (optional). PII handling, consent, access requests. Often required for healthcare or consumer-facing apps.
• Processing Integrity (optional).Data accuracy, completeness, monitoring. Rarely scoped — usually relevant only for financial/regulated domains.

Practical advice: scope just Security for your first audit. Add others when a customer explicitly asks for them. Adding scope adds cost and time.

Type 1 vs Type 2

• Type 1— a snapshot. “On June 1, 2026, your controls were in place.” You can get this in 2-3 months.
• Type 2— a movie. “Over the past 6-12 months, your controls were in place AND operating effectively.” Real validation; takes longer to earn.

Most customers will accept a Type 1 for the first 6 months while you accumulate a Type 2 audit window. Plan for both: Type 1 quickly, Type 2 the following year.

What the audit actually checks (Security)

1. Logical access: SSO, MFA, role-based access, periodic access reviews, deprovisioning on termination.
2. Change management: code reviews, approved deploys, audit trail of who changed what.
3. Vulnerability management: dependency scanning, regular patching, a documented process for handling discovered vulns.
4. Risk assessment: a documented risk register, regularly reviewed.
5. Vendor management: a list of your subprocessors, their SOC 2 status, periodic review.
6. Incident response: a documented plan, tested at least once, incident log with timestamps.
7. Encryption: data in transit (TLS), data at rest (database + backup encryption), key management.
8. Monitoring: logs, alerts, retention policy (typically 90+ days), who reviews them.

The pragmatic timeline

• Month 0-1: pick a compliance platform (Vanta, Drata, Tugboat). Connect integrations.
• Month 1-3: remediate gaps. Most are policy documents you need to write + a couple of technical changes.
• Month 3-4: select an auditor. Schedule the audit.
• Month 4-6: the audit itself. Auditors collect evidence; you answer questions; they issue the report.
• Month 6-18: the Type 2 observation window. Controls keep operating; evidence accumulates automatically via your compliance platform.

What NOT to do

• Don’t try to do this without a compliance platform. The platforms automate ~70% of evidence collection.
• Don’t scope all five criteria for your first audit. Security only.
• Don’t pick the cheapest auditor. SOC 2 reports vary in rigor; cheap audits get challenged by sophisticated customers.
• Don’t fake controls. The audit checks evidence, not aspirations. “We have an incident response plan” without an incident response log is a finding.

How we approach this

For clients pursuing SOC 2 via our cybersecurity and security & compliance work, we run the technical remediation in parallel with the policy work. Most customers reach Type 1 within 4 months and Type 2 in the following 12. The total cost (platform + auditor + engineering remediation time) typically lands between $40K and $100K for a small SaaS — not the $500K some procurement teams budget.

Takeaways

• Scope Security only for the first audit.
• Type 1 quickly, Type 2 over the next year.
• Use a compliance platform — Vanta, Drata, Tugboat. Don’t roll your own.
• The audit checks evidence, not intention.