Not Vanta, I researched it though. I examined SecureFrame and Drata, settled on Drata as it's more polished UI which matters to my management - expensive though

Not Vanta, I researched it though. I examined SecureFrame and Drata, settled on Drata as it's more polished UI which matters to my management - expensive though, around 17k. Honestly you might be better off reviewing the COSO principles in the SOC2 standard itself and think how you can implement- it's freely available online. A tip, every time they say compliance in the document they mean compliance with your SLA's. Once you have a rough idea of your control structure you can write out policies - lighter is better - and source several online for free, after all of that you can engage an auditing firm who will give you a pre-assessment phase before moving into your SOC2 Type 1 or 2. Type 1 is a single day's control monitoring, Type 2 is over a period of time. Edit: Bah wrote all of this thinking SOC2. The ISO is behind a paywall, and heavier to implement in my professional opinion though there is a lot of overlap. I would seriously consider possibility of getting a SOC2 over ISO, for US customers it's almost all SOC2 as a requirement.