A customer wants SOC 2. What can you realistically do in 90 days?
A founder’s plan for turning an urgent customer request into a credible audit-readiness program—without putting the company on pause.
“We need SOC 2 in three months” is rarely a compliance problem alone. It is a sales deadline, an operating-model test, and a request for evidence that your company can be trusted. Ninety days can be enough to become meaningfully audit-ready. It is not enough to manufacture a mature security program overnight.
Days 1–15: define the promise
Start with the commercial ask. Which customer requires the report? Do they need a Type I or Type II report? Which systems and services are in scope? A vague scope creates unnecessary controls, evidence, and cost.
Name one accountable leader, select the auditor early, and document the boundary around the product, infrastructure, people, and vendors that support the service.
- Choose the report and target date with the auditor.
- Map the systems and people inside scope.
- Turn every gap into an owner and due date.
Days 16–45: fix the controls that produce risk
Prioritize access, change management, incident response, backups, vulnerability management, vendor oversight, and workforce practices. Policies should describe how the company actually works; a copied policy that nobody follows is future audit evidence against you.
- Enforce MFA and remove stale privileged access.
- Create a repeatable joiner, mover, and leaver process.
- Test a restore and run an incident tabletop.
- Record approvals for production changes.
Days 46–75: operate and collect proof
Auditors evaluate evidence, not intent. Run each control on schedule and retain the output. Screenshots are useful, but durable records—tickets, logs, review exports, meeting notes—are easier to defend and repeat.
Days 76–90: test the story
Run a readiness review as though the audit has started. Sample evidence, trace exceptions, and make sure the people named in policies can explain their responsibilities. Any gap that remains should have a documented risk decision rather than a hopeful promise.
Useful now, not someday.