Roadmap

Seven phases. Each has an exit test. Do not start the audit clock (Phase 5) until Phase 4 has run cleanly for a full month, because every miss inside the observation window becomes an exception printed in the report.

Indicative timeline for a two-person team working part-time on this: Type I in about 4 to 6 months, Type II about 4 months after that. The hosting move in Phase 2 is the longest single item.

Phase 0: decide (week 1)#

• Name the owners in 00. At least two people, so that change approval can be separated from authorship.
• Approve the scope: system, criteria, products.
• Decide the hosting path (cloud region in India, or colocation).
• Decide on tooling: a compliance automation platform or this repository plus scripts (see below).
• Read the internal gap assessment (soc2-internal/gap-assessment.md) and accept or reorder its priorities.

Exit: owners named, scope signed, hosting path and tooling chosen, budget approved.

Phase 1: foundations that cost nothing (weeks 1 to 3)#

• Enforce MFA everywhere in ACC-03: GitHub organization, Cloudflare, registrar, cloud console, email, Gate admin.
• Move every repository of an in-scope product into one GitHub organization. Turn on branch protection, required review, required CI, secret scanning, Dependabot.
• Create named accounts for every person; remove shared logins.
• Start the incident log and the change log, even before the policies are signed.
• Turn on off-box encrypted backups for every in-scope database.
• Start using the SOC 2 gate on in-scope repositories.

Exit: ACC-02, ACC-03, CHG-01, CHG-02, CHG-03, AVL-03 operating.

Phase 2: platform (weeks 2 to 10)#

• Stand up in-scope production on the chosen host. Production hosts run production only.
• Central logging with 1-year retention in India; alerting to a paging channel (not a public topic).
• Host baseline: firewall default deny, only 443 from the edge, admin access through an MFA-protected path, disk encryption, audit logging, unattended security updates.
• Deploy pipeline: build from the merged default branch, record each deploy.
• Vulnerability scanning: dependencies in CI, containers and hosts weekly.
• Endpoint baseline for every laptop and desktop used to reach production.

Exit: in-scope products serve from the new platform; ACC-08, ACC-11, OPS-01 to OPS-05, CHG-04, CHG-06 operating.

Phase 3: paper (weeks 3 to 8, in parallel)#

• Fill the placeholders in policies 10 to 25 and the system description. Every sentence must be true on the day of signing.
• Directors approve the policy set GOV-01. Personnel acknowledge GOV-04 and complete training GOV-08.
• First risk assessment RSK-01 and vendor reviews for high-risk vendors VND-02.
• Business continuity plan with RTO and RPO per service BCP-01.

Exit: every policy signed; risk register and vendor register reviewed and dated.

Phase 4: dry run (one full month minimum)#

• Operate every control at its stated frequency.
• Run a first access review, a restore test per database, and an incident tabletop.
• Commission the penetration test MON-02 and fix critical and high findings.
• Do an internal readiness check: walk the control matrix and produce the evidence for each control as if the auditor asked. Anything that cannot be produced is a Phase 4 failure.

Exit: a clean month with no missing evidence.

Phase 5: Type I examination#

• Engage a licensed CPA firm. Get two or three quotes. Ask each: are they AICPA peer-reviewed, have they audited companies of our size, do they accept a compliance automation platform's evidence exports, what is the Type I to Type II bundle price.
• Provide the system description, control matrix, policies and evidence as of the report date.
• Fix any design deficiencies the auditor raises before the report date where possible.

Exit: Type I report issued. Now, and only now, the honest phrase in 00 may change.

Phase 6: Type II observation and examination#

• First window: 3 months, starting the day after the Type I date. Then 12-month windows, back to back, so there is never a gap in coverage.
• Keep the evidence calendar. Quarterly self-assessment MON-01.
• The auditor samples evidence across the window and issues the Type II report.

Exit: Type II report issued; next window already running.

Phase 7: keep it#

• Bridge letters for customers between report periods.
• Add second-scope products (Tulip, Planet, Scribe, AIBookly) when they meet the entry criteria.
• Consider ISO 27001 if UK, EU or Indian enterprise buyers ask for it; most SOC 2 controls carry over.

Tooling choice#

Either way, the policies in this section are the source. A platform's templates are a starting point, not the truth about how RM operates.

Budget ranges (verify with quotes)#

These are rough market ranges for a company of RM's size as of 2026. They vary widely. Get quotes before committing.