How much time SOC 2 actually takes you
Between 200 and 500 hours for a first report, and the shape matters more than the total. Two heavy months at the start, a long thin middle, and a spike during fieldwork that arrives when nobody has planned for it.
A first SOC 2 takes 200 to 500 hours of internal time at a company under 100 people, and the person who owns it needs roughly 12 to 16 hours a week during preparation, 3 to 5 hours a week through the observation window, and 15 to 25 hours a week during fieldwork. A CTO can run this alongside their real job, but only if the two heavy phases are a reduced load rather than added on top, and only if somebody else owns vendor and people evidence. The teams that slip are rarely short of skill. They are the ones where the owner had no hours.
12 to 16 Owner hours per week, preparation phase
3 to 5 Owner hours per week, during the window
15 to 25 Owner hours per week, during fieldwork
The shape of the year
| Phase | Elapsed | Owner hours per week | Total hours, whole company |
|---|---|---|---|
| Scope, gap analysis, auditor selection | Weeks 1 to 4 | 12 to 16 | 30 to 60 |
| Policies, remediation, long-lead items | Weeks 5 to 12 | 12 to 16 | 90 to 250 |
| Observation window, evidence collection | 3 months | 3 to 5 | 40 to 100 |
| Fieldwork and auditor questions | 4 to 8 weeks | 15 to 25 | 40 to 80 |
| First report, total internal hours | Averaging 8 to 10 | 200 to 500 |
The window row is the one people misread. Three to five hours a week sounds trivial, and it is the phase where most first attempts fail. The work is small, recurring and easy to skip, and a skipped month cannot be reconstructed. The evidence has to exist inside the window with dates inside the window, which evidence collection sets out and shipping through the window covers for a team still releasing weekly.
Can a CTO run this alongside the real job?
Partly, and the split is predictable. The parts that fit are the ones only the CTO can answer: scope, the system description, architecture decisions, and fieldwork questions. The administrative parts do not fit. They are not hard, they are relentless, and they compete with shipping every week.
| Work | Keep or move | Why |
|---|---|---|
| Scope and system boundary | Keep | Nobody else can decide what the report promises |
| Technical remediation decisions | Keep | They are engineering decisions with security consequences |
| Fieldwork answers | Keep | A wrong answer here costs a round trip and a week |
| Policy drafting from templates | Move | Anyone literate and careful can draft. The CTO reviews |
| Vendor register and risk ratings | Move to finance or operations | They already know every subscription and every invoice |
| Onboarding, offboarding and training records | Move to people operations | The records live in their tools already |
| Chasing evidence every month | Move, with a named owner and a calendar entry | It is the highest-frequency, lowest-skill task in the project |
Move those four and the CTO load drops from 12 to 16 hours a week to about 6 to 8 during preparation, a load that survives a normal quarter. Leave them in place and the project competes with the roadmap, and the roadmap wins until a customer deadline forces the issue. Who else in a small company can take each piece is on SOC 2 with no security team.
The fieldwork spike surprises everyone
Companies plan for preparation and forget that fieldwork is the second heavy phase. The auditor asks for populations, samples them, comes back with questions, and expects answers in days rather than weeks. Book 15 to 25 hours a week for the owner across those four to eight weeks, and do not schedule it against a release or a fundraise. What arrives and when is on the audit request list.
What makes the number 500 instead of 200
- No single sign-on. Access evidence collected system by system across twenty tools is the largest avoidable time sink in the project.
- No ticketing discipline. Change management evidence is easy when changes go through pull requests and tickets, and close to impossible to reconstruct when they do not.
- Policies written to impress rather than to describe. Every aspirational sentence becomes evidence you have to produce for twelve months.
- More than one criteria category. Each adds controls, evidence and hours, which criteria beyond Security quantifies.
- Starting the window before the controls run. The most expensive mistake available. The fix is a new window and another three months.
What it costs after the first report
Roughly a third of the first-year hours, if the program kept running rather than restarting. That is 60 to 150 hours a year: a few hours a month for the owner plus a fieldwork spike. Companies that treat the report as finished and stop collecting evidence pay close to the first-year number again, and discover it in the month the next window opens.
How many hours a week does the person running SOC 2 need?
Twelve to sixteen during preparation, three to five during the observation window, and fifteen to twenty five during fieldwork. Averaged across a first report that is eight to ten hours a week for six to nine months.
Can our CTO do this while still writing code?
Yes if vendor, people and evidence-chasing work goes to somebody else, which brings the CTO load to six to eight hours a week outside fieldwork. Without that split it is effectively a second half-time job for a quarter.
What does it cost in dollars if we count our own time?
At a loaded rate of $80 to $150 CAD an hour, 200 to 500 hours is $16,000 to $75,000 CAD that appears on no invoice. It is the largest single line most first-time budgets omit.
Does a compliance platform reduce the hours much?
It reduces evidence collection during the window, which is the smallest of the three phases. It does not reduce scoping, policy work, remediation or fieldwork. Expect a saving of tens of hours rather than hundreds, and read readiness without a platform before assuming otherwise.
What happens if the owner leaves mid-project?
The window usually develops a gap, because evidence collection stops before anyone notices. Name a second person from the start who knows where the evidence lives, even if they never do the collecting.
Work out whether you have the hours
The readiness scorecard shows how much of the work is already done. That decides the number.
Score your readiness