Is SOC 2 a certification?

No. It's an attestation report from a CPA firm, and it carries the auditor's opinion with any exceptions listed. Nobody is "SOC 2 certified", although the phrase is common. A buyer reads the exceptions, so a clean platform matters more than the logo on the website.

Do we need a compliance automation tool?

It depends on the team. A tool collects evidence and tracks policies well, and it saves time once the controls exist. It doesn't build the controls: the identity setup, the pipeline, the logging, and the backups are still engineering work. I'd get the platform right first and let the tool read it.

Which comes first, the questionnaire or the audit?

In the deals I see, the questionnaire comes first by months. I'd answer it honestly, fix the "not yet" lines that block the deal, and start the audit when the controls have run for a while. Which question on your last questionnaire was the hardest to answer?

All guides

Guide

SOC 2 and security questionnaires for startups

What a SOC 2 report and an enterprise security questionnaire ask of a startup's cloud platform, and what to build before the first big deal.

SOC 2 is a report, not a law. An independent CPA firm examines a company's controls against the Trust Services Criteria of the AICPA and writes down what it found. Security is the one category every report covers. Availability, processing integrity, confidentiality, and privacy are added when the customers ask for them.

I'm starting to see a lot of startups meet SOC 2 through a sales deal. An enterprise buyer sends a security questionnaire and asks for the report in the same email. The questionnaire arrives first, and its answers have to be true on the day they're sent. I wrote this guide for the platform behind both documents.

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Does it apply to you?

If one of these lines describes your company, the rest of this guide applies. If none does, the rule probably sits outside your company. A thirty-minute call confirms that faster than the text can.

We sell software or a service to larger companies, and their procurement team has asked for a SOC 2 report.
We've received a security questionnaire with a deadline, and some of our honest answers would be "not yet".
We hold customer data in AWS, Azure, or Google Cloud, and nobody can show in an afternoon who has access to it.
We're planning a SOC 2 audit in the next twelve months and want the platform ready before the observation window starts.
We already have a report, and the next audit found the same exceptions as the last one.

What it asks of your platform

The security criteria, read as a cloud platform

The security category is written as criteria, not as a list of settings. In a cloud account they come down to a short set of facts. Every person signs in through single sign-on with multi-factor authentication. Access follows the job and is reviewed. Changes reach production through a pipeline with a review, and logs, backups, and alerts exist and get tested.

Type 1, Type 2, and the observation window

A Type 1 report describes the controls on one date. A Type 2 report covers a period, often three to twelve months, and tests whether the controls worked for all of it. That period is the part teams underestimate. A control that starts in month four leaves three months with nothing to show, so I build the controls before the window opens.

The questionnaire arrives before the report

A buyer's questionnaire asks the same things as the report, in the buyer's own words, and it wants an answer this week. The questions repeat from deal to deal: encryption, access reviews, incident response, backups, vendors, and penetration testing. I keep one answer library with the evidence behind each line. The second questionnaire then takes an afternoon.

Evidence that collects itself

An auditor asks for samples: the pull request behind a change, the ticket behind an access grant, the alert behind an incident. Evidence gathered by hand at audit time is slow, and it shows gaps nobody knew about. Infrastructure in code, a pipeline that records its approvals, and audit logs in a separate account produce that evidence as a side effect. The audit then reads what the platform already wrote.

How I help

The engineering behind the guide. Each one starts with a map of the platform as it runs today.

Book a call

Where to start

Cloud Security Posture & Hardening

We map every way into your cloud accounts, rank the gaps by what an attacker reaches first, and close the ones that matter, in code, with your team.

$10,000 to $18,000

See what's included

Platform engineering

I do cloud engineering on the platform you already run. I make it calmer, cheaper, and understood by more than one person on the team.

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

FTC Safeguards Rule

What the FTC Safeguards Rule (16 CFR Part 314) asks of a non-bank fintech's cloud platform: a written program, encryption, MFA, testing, and vendor oversight.

New York rules

What New York's DFS cybersecurity regulation (23 NYCRR Part 500) and the SHIELD Act ask of a startup's cloud platform, and how they reach vendors.

US state AI laws

What Colorado's SB 26-189 and other state AI laws ask of a team that builds or deploys automated decisions, read as engineering work.

AI-assisted development

My AI engineering workflow for a team: how I set up Claude Code, Codex, and similar agents with instruction files, retrieval, shared memory, and code review.

Securing AI-generated apps

What changes when an agent writes the code: the new attack paths, the controls that close them on AWS, Azure, and Google Cloud, and the evidence buyers ask for.

GitHub best practices (free)

A free guide to GitOps guardrails on GitHub: rulesets, independent reviewers, required pull requests and checks, Conventional Commits, and branch names.

Is SOC 2 a certification?: No. It's an attestation report from a CPA firm, and it carries the auditor's opinion with any exceptions listed. Nobody is "SOC 2 certified", although the phrase is common. A buyer reads the exceptions, so a clean platform matters more than the logo on the website.
Do we need a compliance automation tool?: It depends on the team. A tool collects evidence and tracks policies well, and it saves time once the controls exist. It doesn't build the controls: the identity setup, the pipeline, the logging, and the backups are still engineering work. I'd get the platform right first and let the tool read it.
Which comes first, the questionnaire or the audit?: In the deals I see, the questionnaire comes first by months. I'd answer it honestly, fix the "not yet" lines that block the deal, and start the audit when the controls have run for a while. Which question on your last questionnaire was the hardest to answer?

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.us or +1 (347) 486-4242