SOC 2 for startups is an interesting topic as one would think that a small, relatively non-complex environment would be easy for obtaining SOC 2 (or even SSAE 18 SOC 1) compliance. Well, yes and no. Don’t you hate the political in the middle answer! Truth be told, the yes part of the answer is that working with a small group of professionals, generally located in one physical location, can make SOC 2 for startups easy going. The no part of the answer is that startups generally lack any type of real and meaningful policies, procedures, and processes. Change control processes? Probably not in place. Documented incident response procedures? Probably not well documented! Security awareness training? Hmm, nope, not being done! Get the picture. That’s the yes and no.

But there is a proven process for SOC 2 for startups that results in an efficient, cost-effective, and security-first mindset that can be had. After all, you’re spending money on a relatively costly compliance mandates (because for startups, your clients and prospects are demanding it), so why not embrace security and make the process worthwhile? Let’s walk through our proven process for SOC 2 for startups and get a better of idea of how it’s done the right way – courtesy of NDNB, one of North America’s leading providers of SOC 2 for startups.

Step 1 – Start with a SOC 2 Scoping & Readiness Assessment

The very first step regarding SOC 2 for startups is to start with an actual SOC 2 scoping & readiness assessment. Why? Because you’ll want to clearly gain a strong understanding of the entire SOC 2 auditing process from beginning to end, and all the moving parts in between. More specifically, a SOC 2 scoping & readiness assessment encompasses the following:

• A brief, yet highly beneficial educational overview of the AICPA SOC 2 auditing framework.
  
  
• An examination of your internal control policies, procedures, and processes, and what gaps need to be corrected/remediated prior to beginning an actual SOC 2 audit.
  
  
• Determining scoping boundaries in terms of business processes to be assessed, personnel to be involved, physical locations to visit, third-parties to include within the scope of your audit, and more.
  
  
• Developing a realistic roadmap for SOC 2 compliance that allows you to reach your goal of obtaining SOC 2 compliance (and the accompanying Service Auditor’s Report) on time and within budget.
  
  
• Word to the wise regarding SOC 2 for startups. Don’t skip this all-important first step on your road to SOC 2 compliance. Look at a scoping & readiness assessment as a highly beneficial and incredibly useful stepping stone towards SOC 2 compliance.

Step 2 – Remediate your Documentation (That’s Policies and Procedures!)

Because startups consist of multiple personnel performing a wide variety of tasks, we often find that someone’s forgot to take the time and develop the much-needed documentation required for SOC 2 compliance. Specifically, we’re talking about information security and operational policies and procedures. Here’s just a small sample of the documents you’ll need to have in place when the auditors show up:

• Access control policies and procedures
  
  
• Change management policies and procedures
  
  
• Data backup policies and procedures
  
  
• Incident response policies and procedures
  
  
• Usage policies and procedures

Again, that’s just a small sample, which at first glance, is quite a bit of documentation to author, especially for startups who are always too busy trying to make their business profitable, and not worrying about policies and procedures. So, what’s the solution? Find a CPA firm that not only offers SOC 2 compliance, but also offers a comprehensive set of InfoSec policies and procedures templates for helping with this all-important task. Still don’t have time to write your policies and procedures – even with the templates provided – no problem, most reputable CPA firms can author the documentation for you fairly quickly. Call and speak with CPA Christopher Nickell at 1-800-277-5415, ext. 706, to learn more about our SOC 2 policy templates.

Step 3 – Roll up Those Sleeves and Remediate Security and Operational Areas

Information security policies and procedures are critical for SOC 2 (and SOC 1) compliance, no question about it, but it’s only documentation, and it carries little weight if the actual processes and procedures are not implemented. You can have a great access control document that says all the right things, but have you actually provisioned IT systems to ensure that strong complexity rules are in place for passwords? Get the point? With that said, startups will have to spend some time remediating – and putting in place – various security and operational measures that have been found during the actual SOC 2 scoping & readiness assessment. After years of performing SOC 2 for startups – and hundreds of other companies – here’s some things to be aware of regarding security and operational remediation.

For security remediation, expect to spend some time re-configuring IT systems, along with purchasing and implementing tools such as two-factor authentication, vulnerability scanning, file integrity monitoring, and more. As for operational remediation, expect to spend time performing a risk assessment, conducting security awareness training, testing your incident response plan, and more. As you can clearly see, these activities are much more than just about writing policies and procedures, they’re about the “doing”.

Ask yourself these key questions when it comes to operational requirements for SOC 2 audits:

Do we perform an annual risk assessment, is it documented, and can we provide such evidence to the SOC 2 auditors?
Do we implement security awareness training for all in-scope employees, is it documented, and can we provide meaningful evidence to the auditors?
Did we test our incident response plan recently, is it documented, and what evidence do we have to show the auditors?

The SOC 2 framework has changed in recent years, a move undertaken by the American Institute of Certified Public Accountants (AICPA) to keep pace with the changes taking place in information technology, cybersecurity, and data privacy. As a result, expect auditors to inquire quite a bit (we do!) about your processes and procedures. How do you hire employees? How do you communicate with your clients for understanding their needs? How do you keep their data safe and secure? It can seem like a never-ending list of questions – and it’s no doubt time-consuming – but once you’ve successfully completed your first SOC 2 audit, it becomes a relatively painless process – when done correctly. To learn more about SOC 2 for startups, contact Christopher Nickell, CPA at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

Step 4 – Do a Dry Run Before the Auditors Begin

Great, so you’ve taken the time to remediate all those gaps identified in Step 1 with a SOC 2 scoping & readiness assessment. It’s now a goo time to do an official “dry run” before the real auditors show up. Simply take the AICPA SOC 2 standard and evaluate your internal controls and policies, procedures, and processes against the prescribed Trust Services Criteria. Feel confident in the results? Excellent, then go ahead and call in the CPA firm you’ve hired to conduct the actual audit.

Step 5 – Know What an Audit is and What to Expect

Here’s how auditors generally work. First, they’ll send out what’s known as a list of deliverables for the audit. Many auditors refer to this as a PBC List (A “Prepared by Client” list of items). A fair number of these items will be asked to be provided to auditors prior to showing up onsite, just so they can get a better idea of your internal controls and relate processes. In the end, auditors look for the following types of evidence:

(1). Policies and procedures: Having well-written information security and operational documentation is key to the success of your overall audit – something I mentioned earlier.
(2). Screenshots of system settings: Expect to provide screenshots of various system settings, such as how servers are configured, what software is running on them, etc.
(3). Proof of operational evidence: Auditors will request materials that can validate you have performed an annual risk assessment, performed security awareness training, tested your incident response plan, and much more.
(4). Interviews: Auditors will often spend a considerable amount of time interviewing personnel for finding out more about their roles, responsibilities, and related processes.
(5). Signed memos: Auditors will often ask you to document a control via a signed memo.

And don’t forget something very important – communication with your auditors is absolutely key to the success of your SOC 2 audit. Don’t make assumptions, and don’t think the auditors are out to get you! They’re just doing their jobs, so be open and transparent with them at all times. Asking for help is also something auditors often here, so if you’re in need of expert guidance, need policy templates, or more, a well-versed SOC 2 auditor will assist, no question about it. To learn more about SOC 2 for startups, contact Christopher Nickell, CPA at 1-800-277-5415, ext. 706.

Step 6 – Keep in Mind that SOC 2 Audits are an Annual Exercise

There’s no one-and-done when it comes to SOC 2 for startups. In fact, most organizations will have to perform a SOC 2 audit each year. Why? Because your clients, prospects, investors – anybody with a true and credible interest in your business – want to be reassured of your internal controls. They want confidence that your policies, procedures, and processes are operating as designed. To learn more about SOC 2 for startups, contact us today and receive a competitively priced, fixed-fee, one that includes a scoping & readiness assessment, SOC 2 InfoSec policy templates, and so much more.

Next Steps – Let’ Talk

When it comes to SOC 2 for startups, NDNB has helped hundreds of businesses throughout the last decade. We have a proven process that works, saving you both time and money in today’s growing world of regulatory compliance reporting. To learn more about SOC 2 for startups, contact Christopher Nickell, CPA at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.