When the customer engaged us, they were 4 weeks from a Series B close and the lead investor had asked, casually, whether SOC 2 was 'in motion'. It wasn't.
Week 1–2 was a gap assessment against the AICPA Trust Services Criteria. We mapped existing controls (mostly informal), identified 47 gaps, and prioritized the 12 with audit-blocker risk.
Week 3–6 was implementation: policy library, MDM rollout, vulnerability scanner, evidence automation via Drata, and access review cadence. Engineering lost about 6 hours per person across the sprint.
Week 7–12 was Type I observation: auditors sampled controls and issued the report. The investor closed. Type II observation began immediately and concluded successfully 12 months later with zero exceptions.
Total cost: less than the customer's annual cyber-insurance premium. Total engineering hours: under 200.