5 Steps to SOC 2 Readiness on AWS in 90 Days

An enterprise prospect has sent over a security questionnaire, and question one asks for your SOC 2 report. You don’t have one, the deal is set to close next quarter, and your engineers are busy shipping product. What now?

A startup on AWS can reach SOC 2 readiness in 90 days by scoping to the Security criteria, building a hardened multi-account foundation, fixing gaps with AWS Config and AWS Security Hub CSPM, automating evidence collection, and running a dry run before the auditor arrives. That gets you to a Type 1 report or the start of a Type 2 observation window, which is what most enterprise buyers ask to see first.

As an AWS Premier Partner and Managed Services Provider, Automat-it runs this plan through TrustGuard, our SOC 2 solution for startups. It covers the initial assessment, gap analysis and remediation, technical implementation, and audit preparation with continuous monitoring.

SOC 2 readiness on AWS at a glance

How do you get a startup SOC 2-ready on AWS in 90 days?

You get there by treating SOC 2 as an engineering project with a fixed end date, then working backwards from the day your buyer needs the report.

Here are the five steps, mapped to the calendar.

1. Which SOC 2 scope should a startup pick in the first 10 days?

Start with the Security category only, and decide early whether your buyer will accept a Type 1 report.

The AICPA Trust Services Criteria cover five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Only Security is mandatory in every report, and each extra category adds criteria to test.

Write a short system description, name an owner for each control, and book your CPA firm now. Download the AWS SOC 2 report from AWS Artifact, because your auditor will rely on it for the infrastructure layer AWS manages.

2. What AWS foundation do SOC 2 auditors expect to see?

Auditors expect central identity, central logging and encryption by default, and a multi-account AWS Landing Zone gives you all three. Use AWS Control Tower to create the accounts, AWS IAM Identity Center with enforced MFA for access, an organization-wide AWS CloudTrail trail for logs, and AWS KMS for encryption at rest.

Facewatch, the UK’s leading facial recognition company, had accounts that didn’t share access or log management. Automat-it built a centralized AWS Landing Zone to unify both, which was a fundamental requirement for passing security audits.

3. How do you find and fix SOC 2 gaps without AWS Audit Manager?

Use AWS Config rules and AWS Security Hub CSPM to find misconfigurations, then fix them in Terraform so the fixes stay fixed. This matters in 2026 because AWS Audit Manager moved to maintenance mode and has not accepted new accounts since April 30, 2026.

AWS now points new customers to AWS Config conformance packs. Automat-it runs a SOC 2 conformance pack as its standard route to continuous compliance without a GRC tool. If you already use Vanta, you can skip AWS Config setup, because Vanta checks those configurations itself; add AWS Config only if you want automatic remediation.

Numenos, a techbio startup handling clinical trial data, needed a SOC 2-compliant setup before its data grew tenfold. Automat-it set up a SOC 2 baseline with AWS Config SOC 2 conformance packs, AWS Audit Manager and Amazon EventBridge, all provisioned in Terraform, with Slack alerts sent through Amazon SNS and AWS Lambda.

4. How do you automate SOC 2 evidence collection on AWS?

Connect a trust management platform such as Vanta to your AWS accounts so control evidence is pulled through the API, not captured by hand. Companies spend an average of 11 weeks a year on compliance tasks, according to Vanta’s State of Trust research for 2025. Much of that time goes on screenshots and access lists.

At Facewatch, Vanta pulled configuration metadata from AWS continuously, which replaced manual screenshots. Facewatch also used Vanta’s policy templates and AI agent to answer auditor requests, which saved weeks of drafting time.

5. When is a startup ready to open the SOC 2 audit window?

You’re ready when every control has run once in a dry run and passed, and your auditor has agreed the evidence format. The AICPA sets no minimum length for a Type 2 observation window, so you agree it with your auditor. Three months is a common first window.

Automat-it customers have reached SOC 2 Type 1 in two months and SOC 2 Type 2 in three months, and passed ISO 27001 in four months, working with Automat-it and Vanta.

The Automat-it stance: don’t wait for the observation window to start fixing things. Every gap you find before day 90 is one the auditor will never see. Every gap you find after it is an exception printed in a report your buyers will read.

For more on what happens after the report is issued, read why SOC 2 continuous compliance monitoring matters for startups and our guide to keeping your startup audit ready with KPI-driven AWS compliance. To set up your account structure, start with the business benefits of an AWS Landing Zone.

Start your 90-day SOC 2 plan

Put a date on your SOC 2 report. Talk to Automat-it’s SecOps engineers about TrustGuard, and get a gap analysis and a remediation plan for your AWS environment in the first two weeks.

Contact Us