A prospect asks for your SOC 2 report. You've never done one. Now you're pricing tools at 11pm and reading a control list that assumes you already know what it means. 

The hard part isn't the work. It's the not knowing: where to start, what it really costs, and what’s required of your engineering team. We'll answer all three.

Kobalt.io has built compliance programs for 1,600+ organizations. We'll walk through a first SOC 2 the way it really runs, start to finish, in plain English. No framework theory. No pitch.

On the agenda:

•  The sequence. Gap assessment, remediation, audit. Type 1 lands around 8 weeks to audit-ready. We'll show you where the rest of the calendar goes. 

• Type 1 or Type 2. Which one your buyer is asking for. Which one to do first.

• Scoping, and why it's the important part. SOC 2 hands you criteria, not a control list. Deciding what satisfies them is a judgment call, and first-timers over-build.

• The real cost. Audit fee, tooling, and the engineering hours nobody budgets for. We'll say the numbers out loud.

 We'll save the last 10 to 15 minutes for your questions. Bring the one you'd rather not ask in front of your board