The Solo Founder's SOC 2 Type II Readiness Checklist

What I Wish I'd Known Before I Bought

I'm a non-technical solo founder, and I bought SOC 2 before I understood what I was buying.

I knew it was coming. The deals I was chasing — enterprise buyers, registered investment advisors, credit unions — were going to make a SOC 2 report a condition of doing business. So when a security questionnaire stalled a deal, I did what I do: I moved. I signed up for a readiness platform fast, felt good about it for about a week and then slowly realized I'd made a string of decisions I didn't know I was making.

I didn't know Type 1 from Type II. I didn't know what a Trust Service Criteria scope was, or that choosing one would quietly set my cost. I didn't know the software and the audit were two different purchases, from two different companies, with two different bills. I figured it all out — just in the most expensive order possible.

This is the guide I wish someone had handed me on day one. Not a vendor comparison. A field guide from someone who went first, so you don't have to learn it the way I did.

---

The five questions I didn't know to ask

Who needs it — and when "who" really means "who's asking"

You don't need SOC 2 the day you launch. You need it the day a buyer makes it a condition. The mistake runs in both directions: buying years ahead of any real reason, or waiting until a deal is already on the table and then trying to compress a months-long process into a procurement deadline.

"Who's asking" should drive two things at once — your scope and your timing. Figure out who's going to demand it, and let that answer almost everything else.

What you're actually buying

Two things people blur together. Type 1 says your controls are designed correctly at a single point in time. Type II says they actually operated, effectively, over a period of months. Buyers increasingly want Type II — the point-in-time version reads like a promise; the over-time version reads like proof.

Then there's scope. Trust Service Criteria are five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is the mandatory baseline. The other four are add-ons, and every one you bolt on means more controls, more evidence and more cost. Choose deliberately.

The part that genuinely caught me off guard: the platform and the audit are two separate purchases. The platform is prep-and-automation software. The attestation (the report your buyer wants) is issued by an independent licensed CPA firm. Two companies. Two bills.

Here's something almost no one tells you: the moment you sign with a CPA firm for your Type II, you can ask for a letter of attestation confirming you're in an active audit period. That letter can unblock deals while you're still mid-window. It's often more useful than a finished Type 1 report and it costs you nothing extra.

When to start the clock

Type II requires a continuous observation window — three months at the very least, commonly six to twelve. The precise version I wish I'd internalized sooner? The clock doesn't start when you write your policies. It starts when you're actually doing what the policies say, and capturing evidence that you did it.

Writing the policy is not the starting line. Operating it is. So don't start until you can sustain it — then work backward from the deal you're trying to close.

Where the money actually goes

Budget for two line items, not one: the platform subscription (annual) and the audit fee — often $5K and up on its own, sometimes at a pre-negotiated rate through the platform, but still payable to the auditor, not the software. Get it in writing which cost is which, and what's bundled.

Budget for the two things that don't show up on anyone's pricing page: penetration testing and incident-response testing. Neither is strictly required by the standard. Both are expected by most auditors. Treat them as separate line items from the start, so they're not a surprise in month three.

Why you're doing it at all

It's a revenue unlock, not a trophy. SOC 2 gets you past compliance — that's the entire job. Which means you scope it to the deals you're actually chasing. Start with Security. Add Confidentiality and Privacy when a bigger deal demands them. Don't pay for criteria you don't need yet to win deals you don't have yet. If you're at all confused, pop it into an LLM and get your answer. I use Claude.

How to buy without getting burned

Before you sign: get your TSC scope in writing. Confirm in plain language whether you're buying Type 1 or Type II. Separate the audit fee from the subscription in the contract. Make sure the contract term is long enough to contain the observation window — a six-month term cannot deliver a twelve-month Type II.

If you're quoted six months, ask the honest question: will I have to renew for another six before this is done? That renewal is your real annual cost. Then ask who the auditor is, and confirm they're independent and peer-reviewed.

---

The readiness checklist

Here's the order I'd run it in if I were starting over today.

Phase 1: Before you buy

• Confirm a real buyer driver. Don't buy ahead of a reason; don't wait until a deal is already on the table.
• Decide Type 1 vs. Type II based on what buyers actually ask for.
• Pick your TSC scope deliberately — Security first, additional criteria only as deals require.
• Get every cost in writing: the subscription, the separate audit fee and the line items that don't appear on pricing pages (penetration testing, incident-response testing).
• Match the contract term to the observation window — and price in the renewal you'll likely need before the report is issued.

Phase 2: Scope and policies

• Only generate policies you can actually follow. The auditor checks that you do them — continuously, with evidence.
• Cut controls that don't fit a solo or very small company, rather than claiming things you can't sustain.
• Understand each concept before you commit to it — access review, vendor risk assessment, change management. If you can't explain it, you can't operate it.

Phase 3: Evidence and the observation window

• Start accumulating evidence from day one of the window (remember, the clock counts the doing, not the writing).
• Automate evidence collection wherever the platform allows.
• Know that gaps in the window become findings in the report.
• Plan for the long middle. It might sound counterintuitive, but getting set up is easier; staying on top of controls for the full window is where most solo founders slip.
• Put recurring tasks on a calendar before you need them.

Phase 4: The audit

• The audit is performed by an independent CPA firm, not the platform.
• Expect them to test whether your controls operated, not just read your documents.
• Have your evidence organized before the audit period, not scrambled together after.
• Ask your CPA firm for a letter of attestation once you sign — it can move stalled deals while you're still inside the window, at no extra cost.

---

Landmines I hit or barely dodged

• Buying before I knew my scope — then generating dozens of policies I didn't understand.
• Writing aspirational policies I couldn't actually follow. They don't make you look good; they turn into audit findings.
• Assuming the audit was bundled and cheap — then getting surprised by a separate fee, and by pen testing and IR testing nobody quoted me.
• Treating setup as the finish line. The real work is operating and evidencing controls across the whole window. The slip usually comes in month four, not week one.
• Almost handing the whole thing to an outside team without understanding it myself — which is how founders get stranded the moment that team is fired or walks away.
• Confusing the platform with the auditor. They are not the same company, and they do not do the same job.
• Claiming controls that don't map to a one-person company — employee performance reviews, anyone? "I certify that I am doing an A+ job!"
• A contract term that can't contain the window. Six months in, twelve months out.

---

What I'd look for in a platform now

Knowing what I know, here's what I'd want from the software framed as criteria, because the right tool for a non-technical solo founder is a specific thing, and most of the market isn't built for her.

• It walks you through your policies in a guided conversation — rather than handing you a document to sign.
• Guidance that's built in, not bolted on. Something that understands both the platform and your business, and can explain what you're looking at — instead of leaving you to figure it out alone.
• Guardrails that ask "can you really commit to this?" before you adopt a control — because the auditor will check.
• Honesty about audit independence and the true total cost. No pretending the report and the software come from the same place.
• It reminds you when things are due. Setup is like running a half-marathon, but staying on top of it for twelve months is where the marathon is won.

---

The point

SOC 2 was the most intimidating purchase of my first year — mostly because everyone around it assumed I already spoke the language. I didn't. If you don't either, that's fine. You can still buy it well. You just have to ask the questions before you sign, not after.

That's the whole difference between a clean readiness process and an expensive education. Ask early. Scope tight. Operate what you write. The badge is just the receipt.

---

Patrice Ayling is the founder of MySSAgent, an AI-native Social Security claiming platform built for consumers, financial advisors and the people they serve. She writes about building a venture-scale company as a solo, non-technical founder.

Reviewed for technical accuracy by Joe Widi, founder of SimpleAudit.