Our SOC 2 Type II journey

Last month we completed our SOC 2 Type II examination. This post is for other small teams considering it: what it cost, what hurt, and what we'd do differently.

The numbers

Nine months from kickoff to report. Sixty-four controls. Fourteen people, of whom two spent roughly a third of their time on evidence collection. Auditor fees were in the low five figures; the internal time cost more.

What hurt

Access reviews. We had quarterly reviews on paper but did them inconsistently. The audit forced real discipline: every access grant now has an owner, a reason and an expiry.

What we'd do differently

Start with the audit log. Ours was good but not immutable, and making it tamper-evident mid-audit was stressful. Build it right on day one.

The report is available under NDA to Business-plan customers. Ask your CSM.

← All posts