SOC 2 for a startup: a week by week plan for the first 90 days

In your first 90 days of SOC 2, decide scope and report type, find your gaps, write a small set of policies you will actually follow, and start capturing dated evidence. Do not rush to an auditor until controls have been running. A Type 2 report looks at operation over a period, so early evidence is the whole game.

What is SOC 2, and what does 90 days buy?

SOC is a suite of services CPAs provide for system-level controls at a service organization, per the AICPA. SOC 2 reports on controls relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy. Those are the five trust services categories.

A Type 1 report describes controls at a point in time. A Type 2 report covers how they operated over a period. Practitioner guides commonly cite an observation window of roughly three to twelve months for a first Type 2, though that comes from vendor and consultant material, not from the AICPA page we fetched, so confirm the period with your auditor. The point for you: 90 days of preparation does not equal 90 days of audit-ready evidence. It gets you ready to start the clock.

Weeks 1 to 2: Scope and goal

Pick the customer need driving this. Ask your top prospects which report they require and which categories. Security is the baseline for most; add others only when a customer asks, since each adds controls.

Define the system boundary: the product, the infrastructure it runs on, the people and vendors who touch it. Write it in a page.

Choose an auditor early and talk to them. They can tell you what they will sample and how long the window should be.

Weeks 3 to 5: Gap assessment

List the criteria for your categories and mark each as met, partly met or missing. Safeguard's SOC 2 Type 2 framework page shows the shape of the work: 61 requirements spanning the common criteria, availability, confidentiality, processing integrity and privacy, of which only one is decided by a scan, five need a scan prerequisite plus evidence, and 55 pass only when a person attests with evidence. The lesson holds for any approach. Most of SOC 2 is about people, process and proof, not scanning.

Expect typical gaps: no access reviews, no onboarding and offboarding checklist, no vendor review, no incident response test, undocumented change management.

Weeks 6 to 9: Policies and controls

Write short policies you will follow. Common ones: information security, access control, change management, incident response, vendor management and business continuity. Short and true beats long and ignored.

Turn on the controls that are cheap and clear: single sign-on, multi-factor authentication, laptop disk encryption, branch protection and required code review, backups with a restore test, logging and alerting.

For software you ship, start a component inventory (an SBOM) and a vulnerability triage routine so you can show how you handled known flaws.

Weeks 10 to 13: Evidence and readiness

Start capturing evidence on a schedule: access review exports, ticket samples for changes, incident drill notes, vendor assessments, training completion. Date and store everything in one folder structure by control.

Run a mock review: pick five controls at random and ask someone outside the team to find the evidence in under ten minutes.

Then decide with your auditor when the observation window starts.

What can tooling do, and not do?

Tools can collect evidence from connected systems and keep it organized. They cannot write your policies for you, perform access reviews or show that a person made a decision. Safeguard's documentation describes automated tests mapped to the SOC 2 criteria and connectors for evidence, and says the readiness score is not an audit opinion or a certification. Only an auditor's report is a SOC 2 report.

What to do

1. Ask two or three customers which report and categories they need.
2. Write a one-page system boundary.
3. Run a gap assessment against the criteria for your categories.
4. Write six short policies, and make sure each describes what you actually do.
5. Start dated evidence capture in week 10 at the latest.
6. Agree the observation window start date with your auditor.

Quick check

Sources

• AICPA, SOC suite of services
• Safeguard docs, SOC 2 Type 2 framework
• Safeguard docs, How framework coverage works

Last reviewed: 18 October 2026.