SOC 2 for a 10-person SaaS: what I'd actually do first
A customer just asked for your SOC 2 report. You have ten people, no security team, and a deal on the line. Here is the order I would do things in, and just as important, the order I would not.
First, the thing nobody tells you: SOC 2 is not a certification. It is an attestation - an auditor’s opinion that your controls existed and operated over a period. There is no pass mark and no badge police. That matters because it changes the question from “how do we pass” to “what controls can we honestly run for six months without burning out a ten-person team”.
Second thing nobody tells you: you already run most of the controls. If you have code review on a protected main branch, a CI pipeline that is the only path to production, centralised logs, and offboarding that actually removes access, you have change management, logical access, and monitoring. Most of SOC 2 readiness at this size is not building new things. It is writing down what you already do, closing the gaps where reality drifts from what you would be willing to say to an auditor, and generating evidence without doing it by hand every week.
So here is my actual order:
1. Ask the customer what they need. Sometimes “we need your SOC 2” turns out to mean “our procurement checklist has a box”. A filled-in security questionnaire plus a solid security page has closed plenty of deals without a report. If they genuinely need the report, ask whether Type I (a point-in-time snapshot) is enough to sign, with Type II (controls operating over 3-12 months) to follow. That can pull the deal months forward.
2. Fix the things an auditor and an attacker would both flag. Before any paperwork: SSO or a password manager plus MFA everywhere, admin access trimmed to who actually needs it, laptops encrypted with screen locks, production reachable only through a defined path, backups that you have actually restored once. None of this is compliance theatre. This is the part that protects you.
3. Write the policies last, and keep them honest. Policies describe what you do, not what a template says a company should do. A ten-person company that copies a 40-page enterprise policy pack has just written forty pages of things it does not do, and an auditor will find those. Short and true beats long and aspirational, every time.
4. Automate evidence or you will hate your life. Type II means showing controls operated all period long: access reviews happened, alerts were looked at, changes were approved. Screenshots into a shared drive every Friday does technically work, and it is how teams end up hating compliance. Anything that can emit evidence continuously should - access lists, change records, monitoring coverage. Whether that is a compliance platform or your own scripts matters less than that a human is not the cron job. This is the part I ended up caring about enough to build a product around, so I am biased, but the principle holds whatever tooling you pick.
5. Budget honestly. For a company this size: the audit itself, a readiness pass or platform tooling, and the engineering time to close the gaps. The money is real but the calendar is the real cost - a Type II observation window cannot be compressed with cash. If a deal depends on it, start the clock now.
One more thing, because it is 2026: the questionnaires have started asking about AI. What tools your team uses, what touches customer data, and increasingly, what agents can do to your systems. If an AI agent can deploy to production, that is a change-management control like any other: it needs an identity, an authorisation, and a log. “A model did it” is exactly as acceptable to an auditor as “some engineer did it, not sure which” - which is to say, not at all. Teams that sort attribution out now will find both the audit and the next incident much less painful.
That is the map. If you want a second pair of eyes on the infrastructure and security side of it - the part in step 2 that protects you whether or not an auditor ever shows up - I do a free 30-minute review. Bring your actual stack.