The length of time required to prepare for your SOC 2 audit is really determined by two factors: the maturity of the processes in your organization, combined with the amount of time your staff can carve out to focus on compliance efforts. If you can get all hands on deck, you can be prepared for your SOC 2 Type 1 audit in as little as six weeks. But clearly there will be a trade-off. 

As we’ve previously discussed, SOC 2 includes more than just IT compliance activities — it's a path to good operational governance. Plan to pull in folks from across the organization to assist in the SOC 2 efforts. Expect to loop in an HR person and someone who heads operations. If you have a customer support or call center, include that manager. You will also need to include your network team lead, your development team lead, and if you have an IT compliance or risk management team, include that team lead as well.

How much time will folks across the organization realistically need to get ready for the first SOC 2 audit?

If you're starting from scratch, carve out about eight hours a week for at least six weeks. If your company is more mature, you might be able to consolidate the effort into two or three weeks, but that is aggressive. You can expect to write a lot of policies, document a lot of procedures, and implement a lot of new processes. Don't forget that you will need a recently completed vulnerability assessment or penetration test, and you will need to demonstrate how any subsequent findings are being addressed.

Toss in a vulnerability scan and a process for responding to vulnerabilities, as well as performing table top exercises for both your security incident response plan and disaster recovery plan. On top of that you’ll have to create a full-blown risk assessment which if you haven't been doing can take about 8-10 hours with participants across the organization.

If you are part of a midsize startup or privately held company that's been around for about three years, then there is some good news. It is likely that you already have controls in place to cover over half of the Common Criteria. Your focus will be making sure you've got the right controls to address each Trust Services Criteria.

Final tip

We suggest incorporating SOC 2 readiness assessment activities into your sprints. Also, don't forget to plan about two to three weeks for your very first audit. Depending on who your SOC 2 auditor is, they may perform walkthroughs of all the processes, requiring control owners to be available to explain how their processes work. Our final tip is to not go at it alone. The time savings for your staff is well worth bringing on a coach and SaaS solution like Strike Graph.