# SOC 2 first-week starter pack

This pack is for small SaaS teams that need to get moving before they get trapped in another round of compliance platform demos.

## Day 1: pick the smallest honest scope

- Confirm whether the customer actually needs Type 1 or Type 2.
- Start with security-only unless someone can defend adding more criteria.
- List the systems truly in scope. Keep it tight.

## Day 2: assign owners

For each control area, name one real person.

- access control
- change management
- vulnerability management
- vendor management
- risk review
- incident response

If the owner is a department instead of a person, the control is still fuzzy.

## Day 3: close the obvious access gaps

- remove stale GitHub collaborators
- make sure admin accounts map to real people
- enforce MFA everywhere that matters
- turn on branch protection for production-related repos
- review cloud IAM admins and old access paths

## Day 4: build the first evidence folder

Create one dated folder and start dropping artifacts into it.

- policies
- access review exports
- MFA status export
- dependency alert export
- branch protection output
- review notes

## Day 5: write the policy stubs

You do not need a giant policy library. You need short documents that match reality.

Start with:
- information security
- access control
- risk management
- incident response
- vendor management
- change management

## Day 6: run one review cycle

Review the open gaps, assign dates, and save the notes. A boring repeated process beats a polished scramble.

## Day 7: decide whether you need a platform yet

Ask three questions:

1. Is the real blocker missing process or missing software?
2. Is the evidence surface already broad enough to justify a subscription?
3. Would the money be better spent on the auditor first?

## What to do next

If this free pack feels too bare-bones, the paid Hardened Stack toolkit adds the control matrix, gap-analysis walkthrough, risk register templates, monthly review template, twelve policies, evidence checklists, four GitHub scripts, an AWS IAM review helper, and sample outputs.