# Build a SOC 2 readiness plan for my startup

A gap assessment and phased plan to get SOC 2 Type I and then Type II without over-engineering.

- Topic: Legal & Compliance
- Framework: RTF
- Level: Advanced
- Tags: Legal, Analyze, Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/build-a-soc-2-readiness-plan-for-my-startup

## Prompt

```text
Help me build a SOC 2 readiness plan for my SaaS startup.

**Why we need it and by when:** [e.g. "enterprise deals blocked, need a report in 6 months"]
**Company size and team:** [headcount, who owns security]
**Tech stack:** [cloud provider, identity provider, code hosting, ticketing, HR system]
**What we already do:** [MFA, SSO, code review, backups, logging, background checks, access reviews, written policies - be honest]
**Trust Services Criteria in scope:** [Security only, or also Availability, Confidentiality, Processing Integrity, Privacy]
**Budget and tooling:** [compliance automation tool or not, auditor chosen or not]

Return:
1. Type I vs Type II explained in two sentences, and which path fits my deadline (including the Type II observation window).
2. A gap assessment table: control area (access control, change management, risk assessment, vendor management, incident response, business continuity, HR security, logging and monitoring, encryption) | what we have | gap | effort (S/M/L) | owner.
3. A list of the policies we need to write, kept short and realistic for our size.
4. Evidence auditors typically ask for in each area, so we start collecting now.
5. A phased timeline: readiness, remediation, Type I audit, observation window, Type II.
6. Common startup pitfalls: policies we don't follow, too broad a scope, missing access reviews, untracked vendors.
7. How to answer customers while the audit is in progress (bridge letter, security overview).

Do not claim any control is in place unless I said so. This is general guidance - confirm scope and requirements with a licensed CPA firm performing the audit.
```

## What to fill in

- e.g. "enterprise deals blocked, need a report in 6 months"
- headcount, who owns security
- compliance automation tool or not, auditor chosen or not

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.