SOC 2 Readiness in 90 Days: What Engineering Builds
Choosing SOC 2 is the easy part. The stall is having no plan. This is the quarter of engineering work: scope, policy, controls, and an evidence pipeline, in that order.
Week-by-week SOC 2 readiness plan
Copy as markdown to paste into your repo, or download a branded PDF for sharing with non-technical stakeholders.
Frequently asked questions
How long does it take to get SOC 2 ready?
About 90 focused days to reach readiness — the point where a Type II observation window can start. The window itself then runs three to twelve months, but that part is mostly operating and collecting evidence, not building.
What are the phases of 90 days of SOC 2 engineering?
Four, in order: scope and gap assessment (weeks 1-2), policy and process (weeks 3-5), implement controls (weeks 6-9), and evidence plus kickoff (weeks 10-12). Each phase unblocks the next, so don't start one until the prior phase's blocking items are closed.
Which Trust Services Criteria should I scope for SOC 2?
Security is mandatory. Add Availability if you make uptime commitments and Confidentiality if you handle sensitive customer data beyond the obvious. Skip Processing Integrity and Privacy unless a specific buyer is asking, because each criterion you add is real additional work.
Do I need a compliance platform to get SOC 2?
A platform automates evidence collection but doesn't implement the controls. The teams that finish the controls phase on time are the ones that resisted buying a platform first — implement the control, then let the tool watch it.
What happens after the 90 days of engineering?
The Type II observation window begins, and from there it's operate-and-collect, not build. The most common way teams fail their first Type II is treating the window as done and letting controls lapse — the access reviews and evidence pipeline have to keep running on cadence.
Why do SOC 2 projects stall for a year?
Because the project has no shape and no owner. Squeezed into the margins of everyone's real job, the 90 days of work becomes the year-long stall; a designated compliance owner is what keeps it to 90 days.
Get the next one.
New operating guides as we publish them — practical, infrequent, unsubscribe in one click.
Ninety days of engineering. The stall is having no plan.
Kaan Systems does platform engineering and Terraform for funded SaaS, health-tech, and fintech. Compliance evidence is the by-product of that work. The Teardown sequences the engineering that has to exist before an observation window starts. The Architecture and Compliance Teardown is a written read in about five business days. Book a call.