A compliance walkthrough for startups

Startup Compliance Atlas: quick guide

Choose your industry and current stage, then print the actions and checks for your next team discussion.

Open the full guide
Choose your route

Take the path that fits your requirements.

Start with the requirements you identified above. These routes serve different purposes, and you may need more than one. A SOC 2 report does not settle every legal or contractual question for your business.

The SOC 2 path

A customer wants an independent report about controls protecting your service. Start by confirming what they need. An independent accounting firm performs the examination and issues the report.

AICPA's explanation of SOC reports · Reviewed September 14, 2026

Type 1: controls at a specific date →

Follow this route if your customer accepts a report on the design of your controls at an agreed date.

Type 2: controls working over time →

Follow this route when the report needs to cover how your controls operated throughout an agreed period.

These are different report types. Confirm the appropriate route with your customer and accounting firm rather than assuming you need both in sequence.

ISO 27001

You need to build a security management program and may want it independently certified.

Read the pathway →

HIPAA

Your business handles health information and needs to establish its HIPAA responsibilities.

Read the pathway →

PCI DSS

Your business accepts card payments or provides a service that may affect their security.

Read the pathway →

GDPR

Your business uses personal data and needs to establish which GDPR responsibilities apply.

Read the pathway →
Build your plan

Build a plan your team can keep running.

Choose your industry and where you are today. Use the actions below to move from understanding the requirements to assigning work, saving records, and keeping up with changes. Return to this plan as your business grows.

What are you building?
Where are you today?

Next outcome / B2B software

A documented scope connects your obligations to the systems and data you actually use.

Do not buy an audit against a scope nobody has agreed on.

  • Collect customer security requirements and relevant contract commitments. Record who needs assurance and when.
  • Map your product, data, people, locations, and vendors. Include the systems your team uses to administer production.
  • Have the appropriate reviewer assess applicable obligations and document exclusions with their reasons.

Prepare: A scope statement, data-flow diagram, and requirements register.

B2B software: before you move ahead

Start with the service a customer wants reviewed, the data it handles, and the assurance they have requested. Identify the people who can confirm security requirements and assessment scope.

  • Ask which integrations and security reviews are required for a pilot.
  • Agree on data use, retention, support, and the limits of the pilot.
  • If a buyer requests SOC 2, clarify report scope and timing with an independent CPA. Readiness work is separate from the examination.

Scope references, checked September 14, 2026: AICPA: SOC services

02 / Put the work in order

Keep these records as you progress.

These stages describe readiness work, not a promised assessment timetable. The scope, evidence requirements, and assessor availability determine the schedule.

  1. 01

    Define what needs to be covered

    A documented scope connects your obligations to the systems and data you actually use.

    Deliverable: A scope statement, data-flow diagram, and requirements register.

  2. 02

    Turn requirements into owned work

    Each requirement has an owner, an implementation task, and a way to verify it.

    Deliverable: A gap assessment and remediation plan with named owners.

  3. 03

    Put controls into operation

    Your team can demonstrate how the controls operate in the scoped environment.

    Deliverable: Implemented controls, approved procedures, and test results.

  4. 04

    Review the evidence and prepare for assessment

    A reviewer can trace each answer to relevant evidence and see unresolved exceptions.

    Deliverable: An evidence index, exception register, and review package.

  5. 05

    Keep the program current

    Controls and evidence stay connected to changes in the business and product.

    Deliverable: A review calendar, change record, and tracked remediation.

From Sythe Labs research

Confirm the assurance request before scoping the work.

A prospect asks for SOC 2 while you are still agreeing on a pilot. Get the request in writing and find out who will review your answer. The product team may be ready to start while procurement is waiting for a report, a security questionnaire, or an explanation of how you handle its data.

Record the requested document, the product and systems it must cover, the reviewer's name, and the decision date. Ask which work must be finished before the pilot can start.

How we sequence SOC 2 readiness ·

Your next action

Which compliance gap will you close next?

Choose one task from the guide, assign someone to resolve it, and agree on what they will bring back. Download your notes before leaving this page; they are not saved between visits.

Download my action plan (.md)

Compliance scope and assurance references

Use the framework owner's guidance to confirm the intended assessment. Our readiness article explains how to sequence the work before independent review.

Choose the first task your team can finish

Take one unanswered requirement from your list. Name the person who will resolve it, the information they need, and when the team will review the answer. Use that decision to start your action plan.

Write your next action