SOC 2 readiness: what it actually takes

SOC 2 arrives as a deadline attached to a deal. That framing makes it a procurement obstacle, and companies treat it accordingly — which is how you end up with policies nobody reads and a repeat scramble next year.

Check what was actually asked for

Before anything else, read the customer’s requirement rather than the summary of it. Type I and Type II are substantially different commitments. Sometimes a security questionnaire and a penetration test would satisfy the request entirely.

This conversation is awkward and occasionally saves several months.

Type II needs calendar time

Type II requires an observation window during which controls are demonstrably operating. That time cannot be bought or compressed, and it comes after remediation, not during it.

Any plan that assumes otherwise will produce a difficult conversation with the customer later, which is a worse conversation than the early one.

Access and change control fail first

Two areas account for a large share of findings: who has access to what and whether it is reviewed, and whether changes reaching production are reviewed and traceable. Both tend to be informal in companies that grew quickly, for reasons that were sensible at the time.

Fixing these genuinely reduces risk, which is not true of every control on the list.

Make controls match the work

A control describing a workflow your team does not use stops being true the week after the audit. It is better to spend the time designing controls around how people actually work, even where that means a longer conversation with the auditor about equivalence.

Automate the evidence early

Evidence collection is where the cost sits in every subsequent cycle. Set it up before the observation window opens and the next audit costs a fraction of this one. Set it up afterwards and you will do this again by hand.

Tooling is not the programme

Compliance platforms are useful for evidence and monitoring. They do not perform remediation, and they will cheerfully automate evidence for a control nobody follows.