PW-SOC2-006
SOC 2 auditor engagement letter before the report
What a SOC 2 engagement letter covers, what to negotiate, and why buyers sometimes ask for it early.
PW-SOC2-002 SOC 2 readiness spoke · Operate · 3/7
90-day SOC 2 Type 1 checklist for SaaS founders
TL;DR. In 90 days most seed SaaS teams can scope Common Criteria, assign control owners, stand up MFA and access reviews, collect a starter evidence pack, pick an auditor, and complete Type 1 fieldwork—if leadership treats readiness as a weekly operating rhythm, not a side quest.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: evidence pack, control owner, Type 1.
Educational only — completing squares does not mean you are audit-ready. Progress is not stored (no localStorage).
If you have no buyer pressure yet, read When to start SOC 2 first (Decide stage — secondary, not Next-in-path).
On this page
WEEK 0 · EMPTY
No evidence folder yet. Create evidence/YYYY-MM/ and name one control owner before Day 1 work begins.
Days 1–30 — Scope and owners
-
One-page system description
-
Choose Trust Services Categories
-
Name control owners
-
Inventory in-scope systems
-
Shortlist auditors
Days 31–60 — Operate the basics
-
Enforce MFA
-
Full access review
-
Publish policies that match reality
-
Vulnerability intake + patch SLAs
-
Weekly evidence pulls
Days 61–90 — Auditor and fieldwork
-
Sign engagement letter; freeze scope
-
Readiness self-check
-
Respond to PBC lists
-
Close gaps; schedule report for procurement
If you miss a week, slide the calendar—do not compress evidence into a heroic weekend. Auditors sample operating rhythm.
Print checklist squares
Use the empty squares below when printing. This page does not save checkbox state (no localStorage). Educational only — completing squares does not mean you are audit-ready.
- Week 0 folder + owner named
- Days 1–30 scope + MFA baseline
- Days 31–60 evidence rhythm running
- Days 61–90 auditor engaged / fieldwork
Questions founders ask
Do we need a GRC tool in the first 90 days?
Not strictly. You need owners, evidence, and an auditor. Tools help when integrations save weekly hours.
Who should own the checklist?
A single accountable lead (often a founder or Head of Eng) with named control owners.
What if we miss day 90?
Extend honestly. Do not fabricate operating history.
Sources
Cost and timeline figures on this site are educational planning ranges, not quotes from AICPA, CSA, Shared Assessments, or any auditor.
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- practitioner ProofWindow educational planning ranges — ProofWindow Editorial — Internal: cost/timeline bands are editorial planning language, not a surveyed dataset. Label Unknown for hard dollars; never attribute invented figures to AICPA/CSA/SA.
Linear path
← Path: SOC 2 Type 1 vs Type 2 for seed startups