How to prepare for a SOC 2 audit

Before you write a single policy, figure out where you actually stand. A gap assessment maps your current controls against the SOC 2 trust services criteria and tells you what is missing.

You can do this yourself with a spreadsheet, hire a readiness consultant for a few thousand dollars, or run it through a compliance platform. The output should be a list of gaps grouped by control family: access management, change management, monitoring, incident response, vendor management, and risk assessment.

Expect to find gaps even if you think you are buttoned up. The first gap assessment usually surfaces 30 to 60 issues. That is normal.

SOC 2 does not give you a policy template, but auditors expect to see a specific set of documents. At minimum, you need:

1. Information security policy (the umbrella document)
2. Access control policy (provisioning, deprovisioning, MFA, least privilege)
3. Change management policy (how code reaches production)
4. Incident response policy (detection, escalation, postmortems)
5. Vendor management policy (how you assess and monitor third parties)
6. Risk assessment policy (how often you review risk and who owns it)
7. Business continuity and disaster recovery policy
8. Acceptable use policy (for employees)

Write them in your own voice. Auditors can spot a copied template from across the room, and copied policies signal that the controls behind them are also fictional. Each policy should reflect what your team actually does, not what a template says you should do.

Have every employee acknowledge the policies in writing. Track the acknowledgments. This becomes evidence later.

Quarterly access reviews are one of the most commonly failed controls in first audits. Pick a cadence (quarterly is standard), a reviewer (usually the system owner or a manager), and a tracking method.

For each in-scope system, the reviewer confirms that every user still needs the access they have. Departed employees should already be gone. Role changes should already be reflected. Shared accounts should be eliminated or justified.

Document the review. Save the input list, the reviewer's decisions, and any revocations that resulted. This is exactly what the auditor will ask for.

Automate where you can: access logs from your identity provider, MFA enforcement reports, branch protection settings on GitHub, vulnerability scan results, backup confirmations, and uptime monitoring. These are all API-accessible and should never be screenshotted by a human.

Accept manual collection for: board meeting minutes, training completion records, vendor contract reviews, and physical security walkthroughs. Build a calendar for these so they do not surprise you.

A fractional CISO handles the automated layer for you, keeping evidence fresh as things change instead of drowning your team in notifications, and applies judgement where a dashboard cannot.

Pick a licensed CPA firm with startup experience. Not all CPAs do SOC 2, and not all SOC 2 auditors understand cloud-native companies. Ask for referrals from peer companies your size. Get fixed-fee quotes from at least three firms. Expect to pay $7,000 to $15,000 for Type I and $15,000 to $30,000 for Type II.

The auditor relationship matters more than the firm name. A responsive auditor who answers questions in a day saves you weeks of project drift.

A realistic first-audit timeline looks like this:

• Weeks 1 to 4: Gap assessment and remediation planning
• Weeks 4 to 10: Policy writing and control implementation
• Weeks 10 to 12: Evidence collection setup and dry run
• Weeks 12 to 14: Type I audit fieldwork
• Months 4 to 9: Type II observation period (typically six months)
• Months 9 to 11: Type II audit fieldwork
• Month 11: Final report

Type II is not optional for most enterprise customers, so plan for it from day one even if you start with Type I.