Startup Compliance Atlas: quick guide
Choose your industry and current stage, then print the actions and checks for your next team discussion.
Take the path that fits your requirements.
Start with the requirements you identified above. These routes serve different purposes, and you may need more than one. A SOC 2 report does not settle every legal or contractual question for your business.
The SOC 2 path
A customer wants an independent report about controls protecting your service. Start by confirming what they need. An independent accounting firm performs the examination and issues the report.
AICPA's explanation of SOC reportsReviewed September 14, 2026
Type 1: controls at a specific date
Follow this route if your customer accepts a report on the design of your controls at an agreed date.
Type 2: controls working over time
Follow this route when the report needs to cover how your controls operated throughout an agreed period.
These are different report types. Confirm the appropriate route with your customer and accounting firm rather than assuming you need both in sequence.
- SOC 2 Type 1
- 01Confirm the request
- 02Put the checks in place
- 03Review the package
- 04Complete independent review
- SOC 2 Type 2
- 01Agree on scope and period
- 02Assign the work
- 03Save records as you go
- 04Work with the auditor
- ISO 27001You need to build a security management program and may want it independently certified.
- 01Define the management system
- 02Assess and treat risks
- 03Operate and review
- 04Prepare for certification
- HIPAAYour business handles health information and needs to establish its HIPAA responsibilities.
- 01Find where health information goes
- 02Analyze risks
- 03Put protections in place
- 04Evaluate changes
- PCI DSSYour business accepts card payments or provides a service that may affect their security.
- 01Map how customers pay
- 02Confirm the assessment you need
- 03Implement and test
- 04Submit and maintain
- GDPRYour business uses personal data and needs to establish which GDPR responsibilities apply.
- 01List the data you use
- 02Document the decisions
- 03Make procedures work
- 04Review new uses
Build a plan your team can keep running.
Choose your industry and where you are today. Use the actions below to move from understanding the requirements to assigning work, saving records, and keeping up with changes. Return to this plan as your business grows.
Next outcome / B2B software
A documented scope connects your obligations to the systems and data you actually use.
Do not buy an audit against a scope nobody has agreed on.
- Collect customer security requirements and relevant contract commitments. Record who needs assurance and when.
- Map your product, data, people, locations, and vendors. Include the systems your team uses to administer production.
- Have the appropriate reviewer assess applicable obligations and document exclusions with their reasons.
Prepare: A scope statement, data-flow diagram, and requirements register.
B2B software: before you move ahead
Start with the service a customer wants reviewed, the data it handles, and the assurance they have requested. Identify the people who can confirm security requirements and assessment scope.
- Ask which integrations and security reviews are required for a pilot.
- Agree on data use, retention, support, and the limits of the pilot.
- If a buyer requests SOC 2, clarify report scope and timing with an independent CPA. Readiness work is separate from the examination.
Scope references, checked September 14, 2026: AICPA: SOC services
Keep these records as you progress.
These stages describe readiness work, not a promised assessment timetable. The scope, evidence requirements, and assessor availability determine the schedule.
- 01
Define what needs to be covered
A documented scope connects your obligations to the systems and data you actually use.
Deliverable: A scope statement, data-flow diagram, and requirements register.
- 02
Turn requirements into owned work
Each requirement has an owner, an implementation task, and a way to verify it.
Deliverable: A gap assessment and remediation plan with named owners.
- 03
Put controls into operation
Your team can demonstrate how the controls operate in the scoped environment.
Deliverable: Implemented controls, approved procedures, and test results.
- 04
Review the evidence and prepare for assessment
A reviewer can trace each answer to relevant evidence and see unresolved exceptions.
Deliverable: An evidence index, exception register, and review package.
- 05
Keep the program current
Controls and evidence stay connected to changes in the business and product.
Deliverable: A review calendar, change record, and tracked remediation.
Confirm the assurance request before scoping the work.
A prospect asks for SOC 2 while you are still agreeing on a pilot. Get the request in writing and find out who will review your answer. The product team may be ready to start while procurement is waiting for a report, a security questionnaire, or an explanation of how you handle its data.
Record the requested document, the product and systems it must cover, the reviewer's name, and the decision date. Ask which work must be finished before the pilot can start.
Which compliance gap will you close next?
Choose one task from the guide, assign someone to resolve it, and agree on what they will bring back. Download your notes before leaving this page; they are not saved between visits.
________________________________
________________________________
________________________________
________________________________
Compliance scope and assurance references
Use the framework owner's guidance to confirm the intended assessment. Our readiness article explains how to sequence the work before independent review.
Choose the first task your team can finish
Take one unanswered requirement from your list. Name the person who will resolve it, the information they need, and when the team will review the answer. Use that decision to start your action plan.
Write your next action