Can you do SOC 2 yourself?
Yes, apart from the audit. Only a licensed CPA firm can issue the report. Everything before that is yours to do however you like.
SOC 2 is outcome-based. The criteria say things like "the entity implements logical access security software, infrastructure, and architectures over protected information assets". They never say "buy this product". An auditor wants to see that the control exists, that it matches what your policy says, and, for a Type 2, that it kept happening. How you collect that proof is up to you.
What a GRC tool would have done for you
It helps to know exactly what you're giving up. A platform does three jobs:
- Collects evidence from your cloud, identity and HR systems on a schedule.
- Tests it continuously and warns you when something breaks.
- Reminds people to do the recurring tasks: reviews, training, sign-offs.
Going without means a person does all three. So the DIY kit below is really a set of substitutes for those three jobs.
The DIY kit: a tracker, folders and a calendar
1. A control tracker
One row per control. Below is a starter set for a Security-only scope. Copy it into a spreadsheet and make it yours.
The starter control tracker
| Control | Usual criteria | Evidence | How often |
|---|---|---|---|
| MFA enforced on all accounts | CC6.1 | Identity provider settings and user export | Capture quarterly |
| User access reviewed | CC6.2, CC6.3 | Signed review for each system | Quarterly |
| Leavers' access removed on time | CC6.2, CC6.3 | Leaver list with removal dates | Per leaver |
| Laptops encrypted and auto-locking | CC6.7 | Per-device settings or agent report | Capture quarterly |
| Anti-malware on every device | CC6.8 | Console export | Capture quarterly |
| Changes reviewed before release | CC8.1 | Pull requests with approvals | Per change |
| Vulnerability scans run and fixed | CC7.1 | Scan reports and tickets | Quarterly at least |
| Risk assessment | CC3.2 | Dated risk register | Annual |
| Vendors reviewed | CC9.2 | Vendor list and their SOC reports | Annual |
| Incident response plan tested | CC7.4, CC7.5 | Tabletop notes | Annual |
| Security training completed | CC1.4, CC2.2 | Completion records | At hire, then annual |
| Policies approved and acknowledged | CC5.3 | Approval record and sign-offs | Annual |
Add two columns of your own: an owner and the date evidence was last collected. The cadences are common practice. SOC 2 does not mandate them, but once your policy states one, the auditor holds you to it.
2. Evidence folders by period
Create one folder per quarter of your audit period, with a subfolder per control. Every file needs to show what system it came from and when. A screenshot with no date and no URL is worth very little.
3. Complete lists of events
For anything that happens per event, the auditor asks for the full list first and then picks samples. Keep running lists of new hires, leavers, production changes and security incidents from day one of the period. Rebuilding them afterwards is the worst week of a DIY audit.
4. A compliance calendar
Put every recurring control on a shared calendar with a named owner. A missed quarterly review can't be backdated.
How to get SOC 2 compliance by hand, step by step
- Scope it. Pick the system and keep to the Security category unless a customer needs more.
- Download the criteria. The AICPA publishes the Trust Services Criteria free with an account.
- Find your gaps. Walk the criteria and list what you do, what you half-do and what's missing.
- Write policies that match reality. Don't promise what you won't do.
- Fix the gaps. Usually access, devices, change control and vendor reviews.
- Engage a CPA firm early. Ask for their evidence request list before you start collecting.
- Run the period and collect as you go. Then hand over the folders.
Where doing it by hand hurts
- Time. Published estimates for a first manual SOC 2 range from 100 to 500 hours or more. These are consultants' and vendors' estimates, not measured data, but nobody claims it is quick.
- Devices. Proving every laptop is encrypted means a screenshot per device per quarter, or a tool.
- Drift. Nobody tells you when someone turns off MFA. You find out at the next manual check, or the auditor does.
- Year two. A twelve-month period means four quarters of all of the above, every year.
When DIY makes sense, and when it doesn't
It makes sense for a team under about 15 people on one cloud, aiming for a Type 1 or a three-month Type 2, with one organized person who has the hours.
It stops making sense when you add a second framework, pass 30 or so devices, or the person holding the spreadsheet is also your lead engineer. At that point compare the hours against what a platform would cost.
With AccuSights: there's a route between the spreadsheet and a five-figure platform. Our agent collects the device evidence, the platform keeps the tracker, and an engineer answers the "is this enough?" questions, for one fixed fee that starts at $6,000 a year for a small business.