The email usually arrives on a Friday afternoon. Your sales team just got off a call with a Fortune 500 prospect, and they're ready to sign—pending one small detail. "We'll need to see your SOC 2 report before we can move forward with procurement."
Suddenly, a compliance acronym you've been vaguely aware of becomes the most important thing standing between your company and a deal that could double your ARR. You Google "SOC 2 timeline" and see estimates ranging from 6 months to over a year. Your prospect wants to close this quarter.
Here's the reality: with focused effort and the right approach, you can achieve SOC 2 Type II readiness in 90 days. It won't be easy, and it will require commitment from leadership, engineering, and operations. But it's absolutely achievable—and this playbook will show you exactly how.
If it feels like every enterprise prospect is asking for SOC 2, you're not imagining things. Three factors are driving this trend:
Supply chain security concerns have reached boardroom-level priority. After high-profile breaches like SolarWinds and the MOVEit vulnerability, enterprise security teams are scrutinizing every vendor that touches their data or infrastructure. SOC 2 has become the de facto standard for demonstrating you take security seriously.
Cyber insurance requirements now often mandate that vendors maintain certain compliance certifications. When your prospect's insurance policy requires them to only work with SOC 2 compliant vendors, there's no negotiating your way around it.
Procurement standardization means that even if the technical team loves your product, the procurement and legal teams have checklists. SOC 2 is increasingly a non-negotiable checkbox—not because anyone doubts your security practices, but because organizations need scalable ways to evaluate vendors.
SOC 2 (Service Organization Control 2) is an auditing framework developed by the American Institute of CPAs (AICPA). Unlike prescriptive standards like PCI-DSS that tell you exactly what to implement, SOC 2 is principles-based. It evaluates whether you've designed and implemented controls that achieve specific objectives.
Type I is a point-in-time assessment. An auditor looks at your controls on a specific date and confirms they're designed appropriately. You can achieve Type I quickly, but it's increasingly seen as insufficient by sophisticated buyers.
Type II examines whether your controls operated effectively over a period of time—typically 3-12 months. This is what enterprise prospects actually want. They need assurance that you don't just have good policies on paper, but that you consistently follow them.
The 90-day timeline in this guide gets you to Type II readiness, with controls operating effectively. Your formal audit period starts when you're ready, not when you first implement controls.
SOC 2 is organized around five Trust Service Criteria. Most companies certify against Security (required) plus whichever additional criteria are relevant to their business:
Security (Required): Can you protect your systems against unauthorized access? This covers network security, access controls, encryption, monitoring, and incident response. Think: Can someone who shouldn't be in your systems get in? Would you know if they did?
Availability: Can customers reliably access your service? This covers uptime commitments, disaster recovery, capacity planning, and incident management. Think: If AWS us-east-1 goes down, what happens to your customers?
Processing Integrity: Does your system process data accurately and completely? This is critical for companies handling transactions, calculations, or data transformations. Think: If a customer sends you data, does the right thing happen to it?
Confidentiality: Can you protect confidential information beyond just security controls? This covers data classification, retention policies, and secure disposal. Think: Do you know where all your customer data lives, and can you delete it when required?
Privacy: Do you handle personal information according to your privacy commitments and regulations? This overlaps with GDPR and CCPA requirements. Think: Are you doing what your privacy policy says you're doing?
For most B2B SaaS companies, Security + Availability is the right starting point. Add Confidentiality if you handle sensitive business data, and Privacy if you process significant personal information.
This timeline assumes you're starting with reasonable engineering practices but limited formal documentation. Adjust based on your starting point.
The first two weeks are about understanding your current state and building the foundation for everything that follows.
Week 1: Assessment and Planning
Week 2: Infrastructure Hardening
Focus on the technical controls that take time to implement properly:
If you're using a platform like Convox, many of these controls are already configured. For example, Convox Racks deploy into private VPCs with proper network isolation by default, and all traffic is encrypted in transit automatically. You can verify your rack's security configuration:
$ convox rack params
high_availability true
private true
node_capacity_type on_demand
...This is the phase most engineering teams underestimate. Technical controls are only half the battle—you need documented policies and evidence that you follow them.
Week 3-4: Core Policy Development
Write (or customize templates for) these essential policies:
Don't write policies that describe an ideal future state. Write policies that describe what you actually do (or can realistically commit to doing immediately). Auditors check whether you follow your policies—a simpler policy you follow beats a comprehensive one you don't.
Week 5-6: Process Implementation
Your convox.yml can serve as documentation of your deployment configuration. Auditors appreciate seeing infrastructure-as-code that enforces consistent deployments:
services:
web:
build: .
port: 3000
health: /health
scale:
count: 2-10
targets:
cpu: 70
deployment:
minimum: 50
maximum: 200
environment:
- DATABASE_URL
- ENCRYPTION_KEY
resources:
database:
type: postgres
options:
storage: 100This configuration demonstrates high availability (multiple instances), health checks, and controlled deployments—all things auditors want to see.
Now that controls are in place, you need to prove they're working. This phase focuses on logging, monitoring, and evidence collection.
Week 7-8: Logging and Monitoring
Convox provides built-in logging that can be forwarded to your SIEM or log aggregation platform. Configure syslog forwarding at the rack level:
$ convox rack params set syslog=tcp+tls://logs.example.com:1234For more granular monitoring, Convox's built-in monitoring and alerting capabilities can help you track the metrics auditors care about. See the monitoring documentation for setup details.
Week 9-10: Evidence Automation
The final stretch is about ensuring everything is documented and ready for auditor scrutiny.
Week 11-12: Gap Remediation and Documentation
Week 13: Readiness Assessment
Use this checklist to verify your infrastructure meets SOC 2 requirements. Items marked as "Platform-provided" are automatically handled if you're using a modern PaaS like Convox.
Network Security
Encryption
Access Control
Convox's RBAC functionality helps implement least-privilege access control across your team.
Logging and Monitoring
Backup and Recovery
Change Management
Convox's deployment model enforces many change management controls by default. Every deployment creates a new release that can be easily rolled back if issues arise.
The compliance tool market is overwhelming. Here's what's actually required versus what's nice to have:
Required:
Highly recommended:
Nice to have but not required for initial certification:
After helping many companies through their first SOC 2 audit, these are the mistakes we see repeatedly:
Engineers often think: "We do this, so we're compliant." But if it's not documented, it doesn't exist to an auditor. The most common documentation gaps:
Fix: Create a habit of documenting decisions in a centralized location. Your compliance platform should be your system of record.
SOC 2 Type II examines controls over time. You can't implement MFA the week before the audit and claim it's been a control. Auditors will ask for historical evidence.
Fix: Start your observation period immediately. The 90-day timeline assumes controls are operating from week 3 onward, giving you 10+ weeks of evidence before audit.
This is surprisingly often the finding that trips up companies. Common issues:
Fix: Create checklists for onboarding and offboarding with required sign-offs. Automate access revocation where possible.
Your production infrastructure might be bulletproof, but if an engineer's laptop doesn't have disk encryption, that's a finding. Endpoint security is part of SOC 2.
Fix: Implement MDM on all company devices. Enforce disk encryption, automatic updates, and screen lock policies.
Every SaaS tool with access to customer data is a potential audit finding. Auditors want to see:
Fix: Start your vendor inventory now. Most SaaS companies have 50-200 vendors; identifying them all takes time.
SOC 2 isn't one-and-done. After your initial certification, expect ongoing requirements:
Continuous activities:
Annual audit:
Each year, your auditor will examine a new observation period. The good news: subsequent audits are typically smoother because controls are already in place. Budget for 20-40 hours of engineering time for annual audits versus 100+ hours for the initial audit.
Control evolution:
As your company grows, your controls need to evolve. What worked at 20 employees won't scale to 200. Plan for periodic reviews of whether your controls still match your risk profile.
One of the biggest factors in how quickly you can achieve SOC 2 is your starting infrastructure. Companies running on well-architected platforms can move significantly faster than those building from scratch.
Convox Rack deployments provide many SOC 2 infrastructure controls out of the box:
This doesn't eliminate all compliance work—you still need policies, processes, and evidence—but it dramatically reduces the infrastructure hardening phase. Instead of spending weeks configuring network security and encryption, you can focus on the documentation and process controls that typically take longer.
For teams using Convox, the rack parameters documentation shows exactly which security configurations are available, many of which map directly to SOC 2 control requirements.
SOC 2 compliance is a significant undertaking, but it's manageable with the right approach. The key is starting immediately—every week you delay is a week less of evidence for your observation period.
Here's your first week action plan:
If your current infrastructure requires significant hardening, consider whether a platform migration might actually be faster than building compliance controls from scratch. Convox provides a Getting Started Guide that can have you deployed in a compliance-ready environment within a day.
Ready to simplify your path to SOC 2? Create a free Convox account and see how a well-architected platform can accelerate your compliance journey. For enterprise deployments or questions about specific compliance requirements, reach out to our team.
You can close that enterprise deal. Let's make it happen.
