Do they know you are a small company? An assembled and audited SOC2 report is not inexpensive and is a lot to ask of a small firm to have already. What is rea

Do they know you are a small company? An assembled and audited SOC2 report is not inexpensive and is a lot to ask of a small firm to have already. What is reasonable is if they are asking you to produce your processes/procedures of how you feel you meet the requirements of SOC2. Also if you are using something like AWS, that can help you satisfy some of the compliance side too. I have been in your shoes where I ran a small company and got an opportunity (eventual deal) with a large Fortune 500 firm and they were asking me for SOC and ISO type reports early on. I was up front with them and said I was happy to share all the details why I felt we were meeting those requirements but I couldn't justify the $10's of thousands of dollars to assemble and have audited these standards and reports at the time. Essentially they had their typical vendor checklist they were looking at and just asked because it was on the checklist. Once I went through the details, they were pretty understanding and helped me get them the information they needed to demonstrate compliance without us having to go through the insanity for a small company that some of these standards require.