From April 10 to May 2, 2024, I did all the work myself to get SOC 2 Type II certified. I'm now half way through the observation period to get Type II. The observation period is easy, you just have to babysit the controls. Getting to Type I is much harder. It took me somewhere around 100 hours.
SOC 2 is a security framework that, for many customers, eliminates the need to have you, as a vendor, fill out a lengthy security questionnaire. The SOC 2 controls and audits ask pretty much all the questions you'd get from a customer's security team. In fact, that is a great way to think about SOC 2. It's essentially a very thorough questionnaire you fill out once, an independent auditor forms an opinion of it in a report, and you share with all your customers.
There are two parts to SOC 2. The initial audit, where an auditor writes a Type I report sharing their opinion of your current setup. Then there's a 3 month observ