# 03 Roadmap: from today to a SOC 2 Type II report

Seven phases. Each has an exit test. Do not start the audit clock (Phase 5) until Phase 4 has run cleanly for a full month, because every miss inside the observation window becomes an exception printed in the report.

Indicative timeline for a two-person team working part-time on this: **Type I in about 4 to 6 months, Type II about 4 months after that.** The hosting move in Phase 2 is the longest single item.

## Phase 0: decide (week 1)

- Name the owners in [00](/soc2/#owners). At least two people, so that change approval can be separated from authorship.
- Approve the [scope](/soc2/01-scope): system, criteria, products.
- Decide the hosting path (cloud region in India, or colocation).
- Decide on tooling: a compliance automation platform or this repository plus scripts (see below).
- Read the internal gap assessment (`soc2-internal/gap-assessment.md`) and accept or reorder its priorities.

**Exit:** owners named, scope signed, hosting path and tooling chosen, budget approved.

## Phase 1: foundations that cost nothing (weeks 1 to 3)

- Enforce MFA everywhere in ACC-03: GitHub organization, Cloudflare, registrar, cloud console, email, Gate admin.
- Move every repository of an in-scope product into one GitHub organization. Turn on branch protection, required review, required CI, secret scanning, Dependabot.
- Create named accounts for every person; remove shared logins.
- Start the incident log and the change log, even before the policies are signed.
- Turn on off-box encrypted backups for every in-scope database.
- Start using the [SOC 2 gate](/soc2/05-soc2-gate) on in-scope repositories.

**Exit:** ACC-02, ACC-03, CHG-01, CHG-02, CHG-03, AVL-03 operating.

## Phase 2: platform (weeks 2 to 10)

- Stand up in-scope production on the chosen host. Production hosts run production only.
- Central logging with 1-year retention in India; alerting to a paging channel (not a public topic).
- Host baseline: firewall default deny, only 443 from the edge, admin access through an MFA-protected path, disk encryption, audit logging, unattended security updates.
- Deploy pipeline: build from the merged default branch, record each deploy.
- Vulnerability scanning: dependencies in CI, containers and hosts weekly.
- Endpoint baseline for every laptop and desktop used to reach production.

**Exit:** in-scope products serve from the new platform; ACC-08, ACC-11, OPS-01 to OPS-05, CHG-04, CHG-06 operating.

## Phase 3: paper (weeks 3 to 8, in parallel)

- Fill the placeholders in policies 10 to 25 and the [system description](/soc2/06-system-description). Every sentence must be true on the day of signing.
- Directors approve the policy set (GOV-01). Personnel acknowledge (GOV-04) and complete training (GOV-08).
- First risk assessment (RSK-01) and vendor reviews for high-risk vendors (VND-02).
- Business continuity plan with RTO and RPO per service (BCP-01).

**Exit:** every policy signed; risk register and vendor register reviewed and dated.

## Phase 4: dry run (one full month minimum)

- Operate every control at its stated frequency.
- Run a first access review, a restore test per database, and an incident tabletop.
- Commission the penetration test (MON-02) and fix critical and high findings.
- Do an internal readiness check: walk the [control matrix](/soc2/02-controls) and produce the evidence for each control as if the auditor asked. Anything that cannot be produced is a Phase 4 failure.

**Exit:** a clean month with no missing evidence.

## Phase 5: Type I examination

- Engage a licensed CPA firm. Get two or three quotes. Ask each: are they AICPA peer-reviewed, have they audited companies of our size, do they accept a compliance automation platform's evidence exports, what is the Type I to Type II bundle price.
- Provide the system description, control matrix, policies and evidence as of the report date.
- Fix any design deficiencies the auditor raises before the report date where possible.

**Exit:** Type I report issued. Now, and only now, the honest phrase in [00](/soc2/) may change.

## Phase 6: Type II observation and examination

- First window: 3 months, starting the day after the Type I date. Then 12-month windows, back to back, so there is never a gap in coverage.
- Keep the evidence calendar. Quarterly self-assessment (MON-01).
- The auditor samples evidence across the window and issues the Type II report.

**Exit:** Type II report issued; next window already running.

## Phase 7: keep it

- Bridge letters for customers between report periods.
- Add second-scope products (Tulip, Planet, Scribe, AIBookly) when they meet the [entry criteria](/soc2/01-scope#scope-entry-criteria-for-a-new-product).
- Consider ISO 27001 if UK, EU or Indian enterprise buyers ask for it; most SOC 2 controls carry over.

## Tooling choice

| Option | What it does | Fits when |
| --- | --- | --- |
| Compliance automation platform (Vanta, Drata, Secureframe, Sprinto, and others) | Connects to GitHub, the cloud provider, identity and HR; collects evidence automatically; ships policy templates; often brokers auditor discounts | The cloud move is happening anyway and the budget allows; saves the most founder time |
| This repository plus scripts | Policies here; evidence collected by scripts on a schedule into a private, append-only store | Budget is tight; accepts more manual work and a longer auditor walkthrough |

Either way, the policies in this section are the source. A platform's templates are a starting point, not the truth about how RM operates.

## Budget ranges (verify with quotes)

These are rough market ranges for a company of RM's size as of 2026. They vary widely. Get quotes before committing.

| Item | Rough range (USD) | Notes |
| --- | --- | --- |
| Type I audit | 7,000 to 25,000 | Smaller firms and those partnering with Indian practices sit at the low end |
| Type II audit | 12,000 to 40,000 per year | Often bundled with Type I |
| Compliance automation platform | 5,000 to 25,000 per year | India-based vendors are usually cheaper; ask about startup pricing |
| Penetration test | 3,000 to 15,000 per year | Must be independent; scope the in-scope external surface only |
| Cloud hosting for in-scope production | depends on load | Size from current usage of the in-scope apps only, not the whole box |
| Cyber insurance | quote | Also closes playbook open question 16 |
| Background checks | per person | Use a provider that operates lawfully in India |