# Seven Practices to Prepare a Startup for SOC 2

DevFeed: [Seven Practices to Prepare a Startup for SOC 2](<https://devfeed.tech/articles/the-soc2-starting-seven-29174.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2020/03/12/soc2-starting-seven/>)

Published: 2020-03-12T17:49:00Z

Content type: tutorial

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [soc2](<https://devfeed.tech/topics/soc2.md>), [Security](<https://devfeed.tech/topics/security.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Google Cloud Identity](<https://devfeed.tech/topics/google-cloud-identity.md>), [okta](<https://devfeed.tech/topics/okta.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [Provisioning](<https://devfeed.tech/topics/provisioning.md>), [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [protected branches](<https://devfeed.tech/topics/protected-branches.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloudtrail](<https://devfeed.tech/tags/cloudtrail.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [github](<https://devfeed.tech/tags/github.md>), [logging](<https://devfeed.tech/tags/logging.md>), [okta](<https://devfeed.tech/tags/okta.md>), [patches](<https://devfeed.tech/tags/patches.md>), [protected-branches](<https://devfeed.tech/tags/protected-branches.md>), [security](<https://devfeed.tech/tags/security.md>), [soc2](<https://devfeed.tech/tags/soc2.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

## AI overview

The article recommends seven practices for startups that expect large-company clients to require a SOC 2 report: centralized identity with 2FA, pull-request controls and CI/CD, centralized logging, infrastructure provisioning with Terraform or a similar tool, AWS CloudTrail and AssumeRole, device management with encryption and current patches, and software vendor risk tracking. It also recommends documenting basic policies.

## Source excerpt

So, you plan to sell your startup's product to big companies one day. Congratu-dolences! Really, that's probably the only reason you should care about this article. If that's not you, go forth and live your life! We'll ask no more of your time. For the rest of you: Industry people talk about SOC2 a lot, and it's taken on a quasi-mystical status, not least because it's the product of the quasi-mystical accounting industry. But what it all boils down to is: eventually you'll run into big-company clients demanding a SOC2 report to close a sale. You know this and worry about it.