SOC 2 Readiness for Indian SaaS: A Step-by-Step Guide

If you're an Indian SaaS founder selling into the US, SOC 2 isn't optional anymore, it's the price of admission to enterprise sales. The good news: SOC 2 readiness is bounded engineering work, not a mystery. Here's the path.

Key takeaways

• SOC 2 is 5 "Trust Services Criteria": Security, Availability, Confidentiality, Processing Integrity, Privacy. Most companies start with Security only.
• Type I = "controls exist on this date." Type II = "controls operated effectively over 3-12 months." US enterprise buyers want Type II.
• Plan 4-6 months for Type I readiness, then 6-12 months of operating before Type II audit.
• The engineering work is real but boring: encryption, IAM, logging, vendor management, incident response.

Why this matters

US enterprise procurement has standardized around SOC 2. Without it, your sales cycle stalls at security review. With it, doors open. For Indian SaaS, the gap between "we have SOC 2 Type II" and "we don't" is often the gap between closing $500K ACV deals and not.

The 8 control areas to build

1. Encryption

Data encrypted at rest (database, backups, object storage) and in transit (TLS everywhere). Use managed encryption from your cloud provider; document the key rotation policy.

2. Identity and access management

SSO for all internal tools (Google Workspace SSO is fine). MFA mandatory. Role-based access. Quarterly access reviews. Document everything.

3. Logging and audit trails

Centralized logging (Datadog, Grafana, CloudWatch). All admin actions logged. Logs immutable, retained for at least a year. Access to logs itself logged.

4. Vendor management

Maintain a register of every third-party service that touches customer data. Get DPAs signed. Annual review of vendor security posture. SOC 2 reports collected from vendors who have them.

5. Change management

Code reviewed by at least one other engineer before merge. Production deployments via CI/CD with approval gates. Document the process.

6. Vulnerability management

Dependency scanning (Snyk, Dependabot, Trivy). SAST in CI. Annual pentest by a third party. Documented remediation timelines for severity classes.

7. Incident response

Written incident response plan. On-call rotation. Post-incident reviews. Customer communication templates.

8. Personnel

Background checks for engineers with prod access. Security awareness training annually. Offboarding checklist that includes credential revocation.

What to ship first (the 90-day plan)

Month 1: SSO + MFA everywhere. Centralized logging. Encrypt anything not encrypted. Sign DPAs with all vendors.

Month 2: Document policies (security, incident response, change management, access control, vendor management). Implement automated dependency scanning. Set up CI gates.

Month 3: External pentest. Annual access review. Run a tabletop incident exercise. Write the post-mortems for any incidents from the past quarter.

By end of Month 4: ready for Type I. By Month 10-12: ready for Type II.

Common pitfalls

The biggest is treating SOC 2 as documentation work. Auditors verify that controls operate, not that policies exist. The second is buying compliance automation tooling (Vanta, Drata) and thinking it's a substitute for actually building the controls. The tooling is excellent for evidence collection, but it doesn't implement the controls. The third is delaying the external pentest until the last minute.

What we recommend

Hire a SOC 2 auditor (CPA firm) early, they'll tell you what they look for. Use Vanta or Drata for evidence collection. Plan 4-6 months for Type I and start the 3-6 month observation window the day Type I closes. Budget ₹15-35 lakh for the audit itself plus internal engineering time.

FAQs

Can we self-attest? No, SOC 2 requires an independent CPA firm.

Type I or Type II? Type II for serious enterprise sales. Type I as a checkpoint.

What does it cost? ₹15-35 lakh for the audit, plus 2-4 engineer-months of internal work for the first round.

How long is the report valid? Most buyers want a Type II issued within the last 12 months. Plan for annual re-audits.

Techpuvi's Cybersecurity & Compliance practice delivers the engineering controls and documentation auditors actually want.