An enterprise prospect asks for your SOC 2 report. You don't have one. The deal now has a clock on it. We see this constantly with US software and services companies, and the good news is that a Type I report within a quarter is realistic for most small teams — if you focus on what actually blocks it.
The usual blockers
- Identity. Shared admin accounts, MFA that isn't enforced everywhere, and ex-employees who still have access to a SaaS tool.
- Access reviews. Nobody has ever formally checked who has access to production.
- Change management. Code goes to production without a recorded review or approval.
- Vendor management. No list of the vendors that touch customer data, let alone their SOC 2 reports.
- Policies that don't match reality. A downloaded template promising things nobody does.
A 12-week path
- Weeks 1–2: scope the system, choose Trust Services Criteria (Security is mandatory; add others only if customers ask), and select an auditor.
- Weeks 2–5: fix identity — SSO, enforced MFA, no shared accounts, automated offboarding.
- Weeks 4–7: require pull-request reviews, protect production branches, log deployments.
- Weeks 6–9: write policies that describe what you actually do, and run your first access review and risk assessment.
- Weeks 9–12: connect a compliance platform to collect evidence automatically, run a readiness check, and schedule the Type I audit.
Type II follows after an observation period, typically three to six months. If you've built the evidence into daily work, it largely collects itself.
Compliance should be a by-product of good engineering, not a separate project you rebuild every year.