First Security Hire: A 90 Day SOC 2 Plan That Survives Fieldwork

The AICPA's Journal of Accountancy wrote on 1 February 2026 that companies who really care about securing customer data "value a proper" SOC examination, and that while nobody wants findings, findings are "an opportunity to improve controls." If you are the first security hire at a software company with an enterprise customer waiting on a report, that attitude is your best asset. Your job is not to produce a clean looking binder. It is to build controls that run without you.

This is a 90 day plan for that situation.

What's affected

You inherit four things on day one, whether or not anyone says so:

• A deadline from sales, usually tied to one named customer.
• A guess about what the auditor will want. The AICPA has not issued a SOC 2 checklist, and one CPA firm says plainly that no one size fits all list exists, so every checklist you find is a suggestion.
• Control owners who think security is your job.
• A tool, or a spreadsheet, that someone already bought or built.

How to check if you're exposed

In week one, ask four questions and write down the answers.

1. What exactly did the customer ask for: Type 1, Type 2, or just a report to unblock a questionnaire? Ask them. One CPA firm advises asking what the client will accept before deciding.
2. Which Trust Services Criteria categories are in scope? Security is required, the rest are optional.
3. Has an auditor been chosen, and has anyone held a scoping call?
4. What is the system boundary: which products, environments and vendors?

If none of those has an answer, that is your first deliverable.

What to do now

Days 1 to 30: scope and baseline

1. Get the buyer's request in writing and confirm the report type and period.
2. Run a readiness assessment against the criteria, either with the auditor or on your own. One CPA firm calls it the closest thing to a checklist that fits your company.
3. Build three inventories: systems, vendors, people. Everything else depends on them.
4. Name an owner for each control area. Do not own them all yourself.

Days 31 to 60: fix the gaps that generate evidence

5. Turn on MFA everywhere it is missing and prove it with exports.
6. Make change approvals mandatory in the code host.
7. Write the shortest policies that match what people already do, then get acknowledgments.
8. Hold a risk assessment session and record it. One CPA firm's guidance says a documented assessment is expected at least annually, with risks rated and tied to responses.

Days 61 to 90: start the clock

9. Run the first access review and confirm removals.
10. Calendar every recurring control with an owner and date.
11. Hold a tabletop incident exercise.
12. Agree the observation period start date with the auditor and tell the company, so nobody is surprised by the first missed control.

How to avoid this trap

• Do not copy a template policy that says things your company does not do. The audit tests what the document says.
• Do not start the observation period before the controls have run once for real.
• Do not become the single owner of everything. A control skipped one quarter is an exception in the report.
• Do not hide findings. They are disclosed anyway, and management gets space to respond.

Why it matters

The first security hire sets the pattern for how the company treats evidence. If the first quarter looks like theater, the second year gets harder. If controls are tied to normal work (reviews in pull requests, access reviews in a ticket, onboarding in the HR flow), the audit becomes a sampling exercise instead of a project.

Try it yourself

Write the top five gaps from your week one assessment on one page, each with an owner and a date. If you cannot assign an owner, escalate that, not the gap.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
• Linford and Company: SOC 2 compliance checklist reality (5 November 2025)
• Linford and Company: SOC 2 risk assessment, what auditors look for (14 January 2026)
• Linford and Company: What Is SOC 2? (14 October 2026)