SOC 2 without the theatre
An audit report can be earned two ways: by building controls you would keep anyway, or by producing screenshots for a few weeks a year. Only one of them makes you safer, and it is not much more work.
Most companies pursue SOC 2 for one reason: a customer asked for it. That is a perfectly good reason. The problem starts when the goal becomes the report rather than the controls the report describes.
Compliance theatre has a recognisable shape: policies copied from a template that nobody has read, access reviews done once a year by clicking approve on every row, and a burst of screenshots in the month before the auditor arrives. It produces a report. It does not reduce risk, and it is exhausting to repeat.
Start from what you would do anyway
Almost every SOC 2 control maps to something a careful engineering team would want regardless of any audit:
- Know who has access to what, and remove it when people leave.
- Review code before it reaches production.
- Back up data and check that restores actually work.
- Notice when something unusual happens, and have a plan for when it does.
If you design these well for your own sake, the audit becomes a matter of showing evidence that already exists.
Four principles for controls that last
1. Automate the evidence, not just the control
Branch protection that requires review is a control. A dashboard that shows every merge to main had an approving review is evidence. Build both at once, and the auditor's sample request becomes a filter on data you already collect.
2. Make the control the easy path
Access requests through a ticket that auto-provisions are followed. Access requests through a policy document that says "ask your manager" are not. If the compliant path is slower, people will route around it, and they will be right to.
3. Fewer, real policies
A twelve-page information security policy that matches how you actually work is worth more than forty template documents. Auditors test whether you follow what you wrote. Write less, and follow all of it.
4. Assign owners with names
"Engineering" does not own the backup control. A named person does, with a calendar reminder for the quarterly restore test and a deputy for when they are on leave.
A realistic timeline
For a product company of 30 to 150 people starting from a reasonable engineering baseline:
- Months 1 to 2: scope, gap assessment, and choosing the controls you will actually operate.
- Months 2 to 4: close gaps, automate evidence collection, write the short set of policies.
- Months 4 to 10: the observation period, where controls run and evidence accumulates.
- Months 10 to 11: fieldwork and the report.
The second year is where the two approaches split sharply. The theatre approach costs the same effort again. The real approach costs a fraction, because the evidence has been collecting itself all along.
Compliance done well is just security with a paper trail. Compliance done badly is a paper trail with no security behind it.
Helps teams turn frameworks like SOC 2 and ISO 27001 into controls that work day to day.
A short consultation: we walk your surface and show where to start.