How to Prepare for a SOC 2 Audit in 90 Days

90 days sounds tight for SOC 2 readiness — but it is achievable if you have the right tools and know exactly where to focus. This plan assumes you are targeting SOC 2 Type I (a point-in-time assessment) as a first milestone, with Type II to follow over a 6–12-month observation period. Here is your week-by-week roadmap.

Before You Start: Define Your Scope

SOC 2 scope means: which systems, services, and Trust Service Criteria are in scope. Narrower is better for your first audit. Most SaaS companies start with Security (required) and Availability (frequently requested by customers). Define your "in-scope system" — typically your production environment, the data it processes, and the people who access it.

Weeks 1–4: Baseline Assessment & Gap Analysis

• Day 1–3: Assign a compliance owner and executive sponsor. Designate a Security Officer if one does not exist.
• Day 4–7: Conduct a gap assessment against the SOC 2 Common Criteria. Use a controls framework or automated platform to identify every gap.
• Week 2: Inventory all systems, services, and third-party vendors in scope. Create a vendor register and identify which vendors require security reviews.
• Week 3: Draft or update your core policies: Information Security Policy, Acceptable Use Policy, Incident Response Plan, Change Management Policy, Access Control Policy.
• Week 4: Prioritise remediation items by risk and enforce MFA on all production systems. This is the single most common finding in SOC 2 audits.

Weeks 5–8: Remediation & Evidence Collection

• Week 5: Implement or document your vulnerability management programme. Run your first vulnerability scan. Resolve all critical findings.
• Week 6: Conduct your first quarterly access review. Remove any stale accounts. Document the review process as evidence.
• Week 7: Deploy security awareness training to all employees. Achieve 90%+ completion and retain completion records.
• Week 8: Complete vendor security reviews for all critical vendors. Ensure BAAs and DPAs are signed where required.

Weeks 9–12: Audit-Readiness Validation

• Week 9: Conduct an internal readiness review (or use Barafaa's AI Auditor Simulator). Identify any remaining gaps and close them.
• Week 10: Brief your auditor on scope, system boundaries, and available evidence. Most auditors require a list of systems and a system description before the fieldwork begins.
• Week 11: Assemble your evidence package: policies, screenshots, access review records, training completions, vulnerability reports, change management logs.
• Week 12: Auditor fieldwork. Be responsive to requests. Designate one person to manage the auditor communication channel.

The 90-Day Timeline at a Glance

What Can Go Wrong (and How to Avoid It)

• Scope creep: Keep your in-scope system boundary tight. Adding systems mid-audit is expensive and disruptive.
• Missing evidence: Start collecting evidence from day one. Auditors want to see that controls operated consistently, not just that they exist at the end.
• Slow remediation: Prioritise critical gaps (MFA, access reviews, vulnerability management). Lower-severity findings can be noted in the report with a remediation plan.
• No executive support: SOC 2 requires board-level oversight evidence. Get sign-off from a C-level sponsor on your security policies.

After the Audit: Planning for Type II

Once your Type I report is issued, the clock starts on your Type II observation period. Most customers request 12 months. Start operating your controls consistently from day one — every access review, every vulnerability scan, every policy update — because your auditor will sample evidence across the entire period.

Using an automated compliance platform like Barafaa means your evidence is collected continuously and automatically, so there are no gaps and no last-minute scrambles.