SOC 2 Type II, one year later

We completed our SOC 2 Type II audit a year ago. This is the post I was looking for when we started the project, and could not find.

What it actually cost

About 0.6 FTE of sustained work on the security team, and roughly 0.2 FTE across engineering for evidence collection. The auditor bill is a line item but a much smaller one than people expect.

What we automated

Access reviews, change management evidence, and vulnerability scanning evidence are now 100% automated. Every Friday morning a worker runs, pulls the week's evidence into our compliance vault, and our security engineer spends about 15 minutes spot-checking.

The three controls that hurt

1. Vendor management. The sheer number of SaaS vendors modern companies use. We now require every new tool to come with a one-page security review before procurement.
2. Backup restore testing. We had backups. We did not reliably test restores. Fixing that meant building a weekly game day.
3. Incident response tabletops. Not because they are hard — because they are easy to deprioritize.