SOC 2 guides

Plain-language answers to the questions small SaaS teams ask on the way to a first SOC 2 report: what a customer is asking for, what it costs, what to include, and what auditors test. Each guide links to the free tool that does the work, and every outside figure is attributed to its source.

A customer is asking

A deal depends on a security review and you have no report yet.

A customer asked for your SOC 2 report: Five questions to ask them, what to send this week, and a status note that doesn't overclaim.
Answering a security questionnaire without a SOC 2 report: Honest example answers, what to attach instead, and which answers add contract risk.
Is SOC 2 a certification?: What a SOC 2 report is, and wording for your website and sales emails that holds up.
Is our data used to train AI models?: How to answer the AI training-data question on a questionnaire, with editable answer shapes.

Planning the audit

Decide what to include, how long it takes and what it costs before you talk to a CPA firm.

SOC 2 cost for startups: Each line item, with every published range attributed to its source.
SOC 2 scope: which Trust Services Criteria to include: Security is required; when to add Availability, Confidentiality, Processing Integrity or Privacy.
SOC 2 Type I vs Type II: What each report covers and what changes in your policies.
SOC 2 observation period: How long it runs, when it can start, and the recurring controls to run and record in it.
What happens during SOC 2 fieldwork: Evidence requests, sampling, and who and what to have ready that week.
SOC 2 exceptions and qualified opinions: What an exception is, the four opinions, and the records that prevent common exceptions.
SOC 2 for a team of 1 to 10 people: Segregation of duties, approvals and incident response when one person holds several roles.
SOC 2 vs ISO 27001: which first: Choose by what your customers ask for; how much of the work overlaps.
How to choose a SOC 2 auditor: Questions to put to every CPA firm before you sign, and how to compare quotes.
HIPAA for SaaS startups: What to have in place before you sign a business associate agreement.

Controls and evidence

What auditors test, and the records that show a control ran.

SOC 2 checklist: Twenty readiness items by area, with why an auditor cares and the fix.
SOC 2 controls list: The criteria by series, with example controls a small SaaS company runs.
SOC 2 evidence checklist: The evidence typically sampled for each criterion, and the policy behind it.
Does SOC 2 require MDM?: The device evidence auditors ask for, and a path without an MDM tool.
Does SOC 2 require a penetration test?: What the criteria and outside guides say, and how to scope a first test.
Does SOC 2 require background checks?: What auditors sample for new hires, contractors, and where local law limits you.
Complementary user entity controls (CUECs): The controls your vendors' reports say you must run, and how to map them.
Where to get your vendors' SOC 2 reports: Trust center links for common startup vendors and what to check in each report.
How to read a SOC 2 report: Read a vendor report section by section, with a checklist for your vendor record.

Policies

Writing, approving and mapping the written policies.

SOC 2 policies list: All 22 policies with owner role, criteria and companion template.
What auditors ask about policies: The questions to expect about your policies, and where the answer lives.
SOC 2 policy acknowledgment: Why auditors ask for it, and a free form to collect it.
SOC 2 to ISO 27001 mapping: Each criterion with the Annex A controls it shares a policy with, as CSV.

Looking for files rather than reading? See the templates, or generate all 22 policies in the generator.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.