There is a predictable moment in the life of a small software company. An enterprise buyer asks for a SOC 2 report. Someone looks it up, sees the price of an audit, sees that companies this size usually hire a person to run it, and quietly hopes the question will not come up again.

It comes up again. It always does.

Here is what actually goes into a SOC 2 Type 2 when there is no compliance team, written for the person who has just been handed this and is trying to work out how bad it is.

Short version: it is a lot of small tasks, not a few hard ones. It takes longer than you want. And most of the effort is habit, not paperwork.

What SOC 2 actually is, in plain words

SOC 2 is a report written by an independent accounting firm that says your company does what it claims to do about security.

It is not a certificate you pass or fail. It is a report describing your controls and whether the auditor found them working. A control is just a rule you follow, like "we remove access within one day of someone leaving."

There are two types.

Type 1 looks at one day. It says your controls were designed sensibly as of that date.

Type 2 looks at a stretch of time, usually three to twelve months. It says your controls actually ran during that period. This is the one buyers want, because designing a good rule is easy and following it for a year is not.

That difference is the whole game. Type 2 is not a document exercise. It is proof of habit.

Decide whether you need it yet

Not every company needs SOC 2 on day one, and starting too early wastes money.

You probably need it when enterprise buyers are asking for it in writing, when deals are stalling in security review, or when you handle data that makes a buyer's own risk team nervous. Personal records, health information, financial details, and legal documents all put you in that category.

You probably do not need it yet if nobody has asked, your customers are small businesses, and you are still changing your product every month. In that case do the underlying security work anyway and get the report when the demand is real.

One thing worth saying clearly. If you handle sensitive personal data, the security work is not optional whether or not you buy an audit. SOC 2 does not make you secure. It makes your security legible to somebody else.

The timeline for a small team

Assume nine to twelve months from a standing start to a Type 2 report in hand. Here is where that time goes.

Months 1 and 2: get honest about the current state. Write down what you actually do today for access, backups, code review, laptops, vendors, and incidents. Not what you intend to do. What happens now. This list is uncomfortable and it is the most useful document in the project.

Months 2 and 3: pick the tools and the auditor. Compliance platforms connect to your cloud accounts, code repository, and identity provider, then watch settings and collect evidence automatically. They do not do the work for you, but they remove the worst of the manual collection. Talk to two or three audit firms in the same period, because their availability drives your dates more than you expect.

Months 3 to 5: close the gaps. Turn on the things you did not have. Enforce multi factor authentication everywhere. Set up logging and alerts. Write the policies. Fix laptop encryption. Formalise how code gets reviewed and deployed.

Months 5 to 6: write and approve the policies. Templates from your compliance platform are a starting point and nothing more. Edit them to describe what you really do. An auditor comparing a beautiful policy against your actual behaviour is the fastest way to a finding.

Months 6 to 9 or 12: the observation window. This is the Type 2 part. Your controls run and evidence accumulates. Nothing dramatic happens, which is the point.

Final month: fieldwork and the report. The auditor requests samples, asks questions, and writes the report.

Small teams almost always underestimate the first two months and the observation window. The middle is the part everyone plans for.

The five trust criteria, and why you should pick one

SOC 2 covers five areas: security, availability, processing integrity, confidentiality, and privacy.

Security is required. The other four are optional and each one adds scope, evidence, and cost.

Start with security only. If a specific buyer demands availability or confidentiality, add it for the next report. Every extra criterion you take on in your first audit is more work during the hardest year to do it.

Resist the urge to take all five to look impressive. Nobody is impressed by scope. They are reassured by a clean report.

The work that actually takes time

The policies are not the hard part. These are.

Access reviews. Every quarter, look at who has access to what and remove what is not needed. This sounds trivial. In practice it means finding every system, listing every account, chasing people for answers, and recording the result. Budget half a day per quarter and put it in the calendar as a recurring event with a named owner.

Removing access when people leave. Auditors sample leavers and check the timing. If your process is "someone remembers," you will fail this. Write a checklist, attach it to the offboarding process, and record the date each account was disabled.

Onboarding records. New joiners need background checks where you use them, a signed acceptable use policy, and security training. Collect these at the time. Reconstructing them a year later is miserable.

Vendor reviews. List every third party that touches your data. Record what they hold, what security evidence you have from them, and when you last checked. This grows quietly and nobody notices until an auditor asks.

Change management. Show that code changes were reviewed before going to production. If your team already reviews pull requests, you are most of the way there. If people push straight to production at 2am, that habit has to change first.

Incident records. You need a written response plan and evidence you follow it. You also need a record of incidents, including the small ones. A company reporting zero incidents in twelve months does not look clean, it looks like nobody is watching.

Backup and restore tests. Having backups is not enough. You need to have restored from one and written down what happened.

Notice how many of these are recurring tasks rather than documents. That is the shape of the whole project.

How to keep evidence without a full time job

The way small teams survive Type 2 is by automating collection and fixing a rhythm for the rest.

Automate what a tool can watch. Cloud settings, laptop encryption, multi factor status, code review requirements, alerting. A compliance platform checks these continuously and flags drift. This is genuinely the difference between a manageable audit and a terrible one.

Fix a monthly cadence for the rest. One hour a month, same slot, one owner. Review any alerts from the platform, confirm leavers were removed, update the vendor list, note any incidents. An hour a month is an easy commitment to keep, and keeping it is what Type 2 measures.

Add a quarterly block. Access reviews, a restore test, and a look at open risks. Half a day.

Store evidence where it is generated. Screenshots in a folder are fragile. Tickets, pull requests, and platform logs are strong because they carry dates you did not type in yourself.

Add it up and it is roughly two hours a month plus half a day a quarter, once the setup is done. That is a real commitment but it is not a headcount.

What it costs

Costs vary by region and company size, so treat these as shape rather than exact numbers.

The audit itself is the largest line item. A compliance platform is an annual subscription and is usually worth it for a small team, because it replaces work you would otherwise do by hand. Penetration testing may be requested by buyers even when the audit does not require it. Then there are the small ones that add up: device management, a password manager, security training, and logging.

The cost people forget is time. Someone on your team will spend a meaningful part of their week on this for a few months. Name that person and adjust what else they own. Pretending the work is free is how it stalls.

The mistakes that cost the most

Writing policies that describe an imaginary company. The template says quarterly access reviews. You do them yearly. Now you have a control you are failing by your own definition. Write what you do, then improve it. Auditors test you against your own claims.

Starting the observation window before you are ready. Fixing controls halfway through the window means part of your evidence shows the old behaviour. Get everything running first, then start the clock.

Treating it as a project instead of a habit. Teams sprint through setup, get the report, and stop. Next year's audit covers next year, and the gap shows. Keep the monthly hour.

Nobody owning it. Shared ownership means no ownership. One person's name on it, with time protected for the work.

Overscoping. All five criteria, every system in scope, twelve month window on the first try. Start with security, a tight scope, and a shorter window. Expand later.

Buying a tool and thinking that is the plan. Compliance platforms remove collection work. They do not do access reviews, restore tests, or vendor diligence for you.

Type 1 first, or straight to Type 2?

Two reasonable answers.

Type 1 first gets a document in a buyer's hands within a few months, which unblocks a stalled deal. It also gives you a rehearsal with the auditor before the real thing.

Straight to Type 2 saves money and avoids doing the same work twice. If no deal is blocked right now, this is usually the better path.

Pick based on whether a specific sale is waiting. If one is, Type 1 buys time. If not, go straight through.

The part nobody tells you

The report is not the outcome. The outcome is that your company now removes access when people leave, checks its vendors, reviews its code, tests its backups, and notices incidents.

That is not audit theatre. Those are the exact controls that prevent the bad day. The report is the receipt.

For a company holding wills, personal records, or anything a family will need at the worst moment of their lives, the receipt matters to buyers and the habits matter to users. Do it for the second reason and the first one takes care of itself.

Frequently Asked Questions

How long does SOC 2 Type 2 take for a small company?

Nine to twelve months from a standing start, including a three to twelve month observation window. If controls are already in place, six months is possible.

Do we need to hire a compliance person?

Not for the first report. One named owner spending roughly two hours a month plus half a day a quarter, supported by a compliance platform, is enough for a small team.

Should we do Type 1 or Type 2 first?

Type 1 if a specific deal is blocked and you need something in hand quickly. Otherwise go straight to Type 2 and avoid paying for the same work twice.

Which trust criteria should we include?

Security only, unless a buyer has asked in writing for more. Each extra criterion adds scope, cost, and evidence work.

Does a compliance platform do the audit for you?

No. It connects to your systems, watches settings, and collects evidence automatically. Access reviews, vendor checks, restore tests, and the audit itself are still yours.

What is the most common reason small teams fail a control?

Policies that describe a stricter process than the company actually follows. Write what you do, then tighten it.

Sources

Further reading: