We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is hosted in AWS). I was tasked with an assignment to investigate what we should do to get SOC 2 type 2 report (one of our clients will probably require it in the future) but quickly found out that the task may be insurmountable for me (I'm just an ops guy and have no experience with certification, compliance and such). I read "Trust Services Criteria" pdf from AICPA website, watched a bunch of youtube videos and spend a few days googling but still at loss.
Currently, we have no real controls in place because the company is so small, we just create tickets in trello, develop a feature and deploy the new code using only common sense without any written procedures, guidelines and rules. I'm not sure where to start and how all the controls should be designed to satisfy an auditor. It feels like I have to write a whole book from scratch without really knowing the subject. If there were at least some sort of documentation templates about how to organize everything I could at least try to adapt that to our case but I wasn't able to find anything like that.
How do one start preparing for SOC 2 completely from scratch? Maybe there are companies that can help with that (not with the audit itself because there is nothing to audit right now but with writing controls specifically)? Any help will be very appreciated. Sorry if the question is too broad but I really have no idea how to get more specific in my situation.