I’ve participated in a number of SOC 2 Type 2 audits. I’ve been in cybersecurity and IT audit for a long time. You might want to reach out to Vanta.Com. The fir

I’ve participated in a number of SOC 2 Type 2 audits. I’ve been in cybersecurity and IT audit for a long time. You might want to reach out to Vanta.Com. The first SOC report is always a bear. You’ll likely have to do one every year. But, they get easier by the second one. If you are going to sell to enterprise customers, it’s table stakes. Also see EnterpriseReady.IO for a lot of other interesting requirements!