SOC 2 Readiness in 90 Days: What Small SaaS Teams Do

A buyer asks for your SOC 2 report. You do not have one. Someone on the team asks how fast you can get one.

Here is the honest answer. In about 90 days, a small SaaS team can get ready. That means a clear scope, written policies, controls that are actually running, and evidence that is starting to pile up. It does not mean you have a report in hand.

This post walks through what those 90 days look like, phase by phase. It also explains what comes after, so nobody on your team promises a buyer the wrong date.

First, what SOC 2 is

SOC 2 is a type of report defined by the AICPA. It is built on the Trust Services Criteria. Security is the one criterion every SOC 2 report must cover. Availability, confidentiality, processing integrity, and privacy are optional. You add them when your buyers or your product call for them.

An independent CPA firm performs the examination and issues the report. Your team does not write it. A consultant does not write it. Neither does a compliance tool.

There are two types:

• Type I looks at whether your controls are designed well and in place at one point in time.
• Type II looks at whether your controls are designed well and actually worked over a period of time. That period is called the observation window. Your auditor agrees on its length with you.

Many buyers want Type II in the end. Some will accept a Type I, or a clear readiness story, while you get there. Ask your buyer what they need before you plan.

What "ready" means

Ready means an auditor could start work without your team scrambling. In practice:

• You know what is in scope and what is not.
• Your policies are written, approved, and match how you really work.
• Your controls are in place and running.
• Evidence is being collected as you go, not rebuilt at the end.
• Your gaps are known, and each one has an owner and a date.

That is the goal of the 90 days. Here is one way to get there.

Days 1 to 30: Scope and foundations

The first month is about deciding what you are covering and fixing the basics.

Pick the scope. Name the product or service the report will cover. List the systems behind it: your cloud account, your code repo, your login system, your support tools, and anywhere customer data lives. A tight scope is easier to run well.

Pick the criteria. Security is required. Add others only if buyers ask or your product needs them.

Name an owner. One person runs the project. Each system also needs an owner who keeps its controls running.

Fix the basics. Turn on single sign-on and MFA for every system in scope. Make sure laptops are managed and encrypted. Remove old accounts. Our five-step security baseline is a good place to start.

Do a gap check. Compare what you do today against the criteria. Write down each gap, who owns it, and when it will close.

Talk to audit firms. Start early. Ask about timing, how they work, and what they need from you. You choose the firm. The firm stays independent.

Days 31 to 60: Policies and controls

The second month is about writing down how you work and making the controls real.

Write the policies. Most teams need policies for information security, access control, change management, incident response, vendor management, backups, and acceptable use. Keep them short. A policy you follow beats a long one you do not.

Match policy to practice. If the policy says you review access every quarter, set the calendar date now. If it says code changes need a review, turn on the rule in your repo. An auditor will compare what you wrote to what you do.

Put the controls in place. Common ones include:

• Code review before changes reach production.
• Access approved before it is granted, and removed when people leave.
• A regular access review with a named reviewer.
• Backups, and a restore you have actually tested.
• Logs and alerts on the systems that matter.
• An incident response plan with names in it.
• A review of the vendors that touch customer data.
• Security training for staff, and background checks where your policy calls for them.

Choose how you will track evidence. Some teams use a compliance automation tool such as Vanta or Drata. Others use a shared folder and a ticket system. Either can work. What matters is that each control has an owner and the proof is easy to find.

Days 61 to 90: Evidence and dry run

The third month is about proving the controls run, and testing yourself before anyone else does.

Collect evidence on a schedule. Save the records each control produces: access review results, change approvals, onboarding and offboarding tickets, training records, backup restore tests. Date everything.

Run a dry run. Pick a handful of controls. Pull the evidence as if an auditor asked for it. If it takes hours to find, fix the process now.

Practice one incident. Walk through one realistic scenario with the people in your plan. Write down what happened and what you would change.

Close or log the gaps. Fix what you can. For anything left, write the plan and the date. Do not hide it.

Agree on the next step with your audit firm. That might be a Type I date, or the start of a Type II observation window.

What happens after day 90

This is the part that often gets lost in a sales call.

The audit is separate. Your CPA firm runs the examination on its own timeline. For a Type I, it looks at your controls at a point in time. For a Type II, it tests them across the observation window.

Type II takes time on purpose. The window has to pass before the firm can finish testing. Your controls must keep running the whole time. Missed access reviews or skipped approvals show up as exceptions in the report.

Then the report. After testing, the firm writes and issues the report. Only then do you have a SOC 2 report to share.

So when a buyer asks for a date, give an honest one. You can say you are in readiness, name your audit firm, and share the expected timing. Some buyers will accept that plus a solid questionnaire. Our post on questionnaires before the audit covers how to handle that stretch.

When a buyer sends their review, our B2B Vendor Security Review Checklist covers both sides.

Where teams lose time

• Scoping too wide, so every tool in the company becomes a control.
• Writing policies that do not match real work.
• Buying a tool and assuming it does the work.
• Leaving evidence until the end, then rebuilding months of records.
• Promising buyers a report date before the audit firm agrees to one.

Where Grey Wing fits

Grey Wing helps teams get ready. We scope, write policies with you, put controls in place in your systems, and keep evidence organized. We do not perform the examination, and we do not issue the report. Your independent CPA firm does that.

If you are planning your first 90 days, we are happy to talk it through.