Most of what a first SOC 2 costs is decided before any evidence is collected. This guide is about that period.
Work backwards from the date
The arithmetic is short and it is the most useful thing in this guide:
report needed Decemberminus fieldwork 4 to 8 weeks → engage an auditor by early Octoberminus observation 3 to 12 months → begin collecting by JanuaryThe observation window is the constraint. It cannot be compressed after the fact, because an auditor can sample a longer period but cannot sample one for which no evidence exists.
Type I or Type II
A Type I reports that controls were suitably designed on a date. A Type II reports that they operated effectively across a period.
There are really only three situations:
A deal is blocked now. Take a Type I as the fastest credible artifact, and start the Type II window immediately, usually the day after the Type I report date.
Three to six months of runway. Skip Type I. The preparation is the same and you end up with the report buyers actually want.
Never scoped a control environment before. A Type I is a reasonable forcing function; it surfaces gaps while the stakes are low.
The five early decisions
| Decision | The failure it prevents |
|---|---|
| Which framework, and why | A year of work that unblocks nothing |
| Scope | An expensive report covering systems nobody asked about |
| Who owns it | Work that is everyone's job and therefore nobody's |
| Evidence window | Discovering in October that the window should have started in January |
| Where evidence lives | Six weeks of fieldwork instead of three |
Scope deserves particular attention. Narrower is faster, cheaper and easier to keep true, and it is far easier to widen a scope later than to narrow one, because narrowing invites the question of what was removed.
Where the time actually goes
Not the controls. Most engineering teams already do the substance of them.
The time goes into producing a defensible record that they happened, on a schedule, with artifacts attached and dated. A team that starts collecting on day one of the window finishes on time; a team that starts when fieldwork begins does not.
A control followed ninety percent of the time earns close to zero credit, not ninety percent. Sampling exists precisely to find the other ten percent. ::
A reasonable first month
Confirm the framework with sales, from real security reviews
Draw the scope boundary and write down every exclusion's reasoning
Name an owner and a deputy
Do the date arithmetic above, in public, with the people affected
Decide where evidence lives, and start collecting the artifacts you already produce anyway
Everything after that is mechanical.