We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is hosted in AWS). I was tasked with an assignment to investigate what we should do to get SOC 2 type 2 report (one of our clients will probably require it in the future) but quickly found out that the task may be insurmountable for me (I'm just an ops guy and have no experience with certification, compliance and such). I read "Trust Services Criteria" pdf from AICPA website, watched a bunch of youtube videos and spend a few days googling but still at loss.

Currently, we have no real controls in place because the company is so small, we just create tickets in trello, develop a feature and deploy the new code using only common sense without any written procedures, guidelines and rules. I'm not sure where to start and how all the controls should be designed to satisfy an auditor. It feels like I have to write a whole book from scratch without really knowing the subject. If there were at least some sort of documentation templates about how to organize everything I could at least try to adapt that to our case but I wasn't able to find anything like that.

How do one start preparing for SOC 2 completely from scratch? Maybe there are companies that can help with that (not with the audit itself because there is nothing to audit right now but with writing controls specifically)? Any help will be very appreciated. Sorry if the question is too broad but I really have no idea how to get more specific in my situation.

  • 1
    Getting SOC2 Type 2 is really expensive. Are you aware of the costs? You should start negotiating with your customer about this requirement so that you do not have to do it.
    – schroeder
    Sep 19, 2019 at 18:42
  • I checked a few companies earlier and the audit itself should be in $20-50k/year range, I suppose? Gap assessment is probably about the same but at least is a one-time payment. And that's not even counting our own time, penetration tests, etc. Yes, I know that the whole thing will be very expensive for a startup but I thought that auditors don't usually help to put new controls in place and only check them. Was it the case for you (you mentioned that you had an experience of getting SOC2 in another comment)? Sep 20, 2019 at 15:12
  • They do not set them up, but there is a lot of work in defining the scope, and the assessor usually helps in that work. The outcome ends up being the definition of the types of controls needed.
    – schroeder
    Sep 20, 2019 at 15:36

1 Answer 1


A requirement is that you get an assessor to evaluate your controls. You actually want to start with that step and get their guidance on how to start because they and you will need to agree on scope and what control set will be relevant.

The reason why you are not getting good guidance from the Internet is because your task is exactly like writing a book and not like passing an exam. Your assessor will help you figure out what you are supposed to be writing and how long your book is supposed to be.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .