SOC 2 for Startups: Quick Guide

You just got the green light for a pilot with Microsoft, but now they're asking for your Sock 2 report. Here's everything you need to know about Sock 2 in 1 minute. Sock 2 is basically like a trust badge that says, "Hey, we take handling your data seriously and we don't let hackers walk right on in." There's two types of sock two audits. Type one and type two. Think of type one like a snapshot. It basically checks that at a single point in time you are fully sock two compliant. Type two is like a video. It makes sure that over the course of 3 months, you maintained compliance. Type one will get you in the room, but type two will keep you there. It's the gold standard. To get ready for the audit, there's a mix of technical and administrative to-dos that you'll have to complete. From there, you'll be ready to kick off your official audit, in which an independent auditor will come in and make sure that everything you say you do, both technical administrative, is what you actually do. Do you conduct background checks on all of your employees? Yes. Do you back up customer data? Of course. Does everyone share the same password? Not here. From there, the auditors will draft one final SOCK 2 report that you can then hand over to all of your enterprises, including Microsoft, to close those big contracts. The bottom line is this. Sock 2 is your official badge to getting to the big leagues. Use Delve and start hitting home runs.