Sooner or later, a big customer asks the question: "Are you SOC 2 compliant?" For many startups, that question arrives before anyone has thought seriously about compliance.
The good news: most of what SOC 2 asks for is just good IT hygiene, written down and done consistently. Here's a practical checklist of the IT foundations auditors will expect to see.
1. Identity and access
- A single identity provider (Google Workspace, Microsoft Entra ID, or Okta) for every employee
- Multi-factor authentication enforced for everyone — not just "encouraged"
- Single sign-on connected to your core SaaS tools wherever possible
- Access granted by role, and reviewed on a regular schedule
- A documented process for removing access the same day someone leaves
2. Device management
- Every company laptop enrolled in a device management (MDM) platform
- Full-disk encryption turned on and verified
- Screen lock and automatic OS updates enforced
- Endpoint protection installed and reporting
- An up-to-date inventory of who has which device
3. Onboarding and offboarding
- A repeatable checklist for new hires: accounts, device, access, security training
- A repeatable checklist for departures: access revoked, device recovered or wiped
- Records showing each checklist was actually followed
4. Cloud and SaaS security
- Admin accounts limited to the people who truly need them
- Logging turned on for your cloud provider and key SaaS tools
- Backups configured and tested for business-critical data
- A list of the vendors that touch customer data
5. Policies (yes, you need them written down)
- Information security policy
- Acceptable use policy
- Access control policy
- Incident response plan
- Employees acknowledge policies when they join, and annually after that
Start before you need it
The biggest mistake we see is waiting until a deal depends on it. Putting these controls in place before you start an audit means less scrambling, a shorter observation period, and far fewer surprises.
Want to know how close you are? Book a free IT audit and we'll map your current setup against this checklist.