You decide it is time to pursue SOC 2.
Maybe a customer asked for it. Maybe several customers asked for it. Maybe your sales team has already told one of them: we're embarking on our SOC 2 journey this year.
Now someone has to make good on that promise. The clock is ticking, so you hire a team to help.
There is a kickoff meeting. A project plan. A list of controls. A platform full of tasks. Everyone agrees this is a priority.
Six months later, the task list is still very much a task list.
So, what happened?
Well, in my experience, the company has hired help but never let that help get to work. It's like hiring a cleaning service, letting them into the foyer, and asking them to point out the dirt in the rest of the house so you can clean it yourself.
01 First, what does SOC 2 actually require from your team?
You might be thinking: the creation of policies, SOPs, testing scripts, new training requirements, tool configurations, TPRM reviews, and the making of lists and checking them twice.
You would be right. All of those things take work. But the hidden requirement I have watched derail entire timelines is the need to invest time and consistent, might I say aggressive, attention.
Lots of both. Usually far more than teams expect, and often more than they have bandwidth to allocate. That severe underestimation is usually the secret behind a stalled SOC 2 project.
That is one main reason companies bring in outside help. It is also why the arrangement can fail if the outside help is not given sufficient access and internal permission to take interim ownership of the workload.
02 Three execution models to remember
First, you can run it in-house. This can work well when the company has someone with the knowledge, the time, and the authority to coordinate the program. "Other duties as assigned" is less promising when those other duties already fill the calendar.
Second, you can hire a team to guide your staff. They assess gaps, explain requirements, build a plan, and review what your people produce. That is a valid model if your people have the time to complete the tasks.
Third, you can hire a team to manage much of the day-to-day work. They coordinate owners, draft materials, track evidence, prepare reviews, and keep the project moving. Your team still makes decisions and operates its controls, but your daily workload is not invaded by SOC 2-related tasks.
I have seen success with all three models. Problems start when everyone thinks they chose the third model, but the company operates as though it chose the second.
03 "We want to stay involved" is reasonable
You should stay involved.
Your leadership should know what the company is committing to. Your staff should understand the processes they will follow. Decisions about risk, budget, system changes, and company policy cannot be handed off casually.
But involvement and control over execution are different things. If the person approving every routine task also has a full-time job running the business, the SOC 2 project will move at the speed of their spare time. Sometimes that is twenty minutes on a Thursday. Sometimes Thursday gets canceled.
The hired team cannot solve that scheduling problem with a prettier tracker.
04 The bottleneck is often hiding in plain sight
Consider a typical chain of tasks. The security team needs a list of systems before it can confirm the scope. Engineering needs to confirm who administers those systems. HR needs to explain the current onboarding process. Leadership needs to decide whether that process should change. IT needs to implement the change. Then someone needs to show that the new process actually happened.
Each step may be manageable. But if every handoff waits for the same person to review an email, find time for a meeting, and personally direct the next action, weeks disappear.
Nobody is refusing to do the work. Everyone is busy. That is precisely the problem.
05 So who should be in the driver's seat?
Someone needs to drive the project. The company needs to own the program.
Those are related responsibilities, but they are not identical.
The person driving the project should be able to assign tasks, follow up with owners, organize meetings, draft materials, flag decisions, and keep work moving between leadership check-ins. If an outside team was hired to do that, give them the access and working relationships to do it.
The company should identify an executive sponsor who can resolve roadblocks and make decisions. Control owners should perform the activities that belong to their roles. Leadership should approve commitments it will be expected to uphold.
A useful question at kickoff is: which decisions require our approval, and what can the team move forward without waiting for us?
Write down the answer. It will save everyone an impressive number of meetings.
06 If you are already stuck, look at what is waiting
You do not necessarily need to start over. Start by reviewing the open tasks and asking: is this waiting on a decision, information, implementation, or evidence? Who is the person able to provide it? Does that person know they own the next step? Does it actually require executive approval? What can the project team prepare before that approval is needed?
This separates genuine decisions from work that simply has not been delegated. It also helps reveal whether the company has enough internal capacity for the approach it chose. If the plan requires employees to spend hours each week on SOC 2, those hours have to come from somewhere. Putting "SOC 2" on a priority list does not add a day to the week.
07 The part nobody tells you
Hiring a SOC 2 team does not mean you can disappear until the report is ready. Regardless of the claims, you cannot just set it and forget it. It also should not mean you pay a team to cheerlead for you from the sidelines.
A good arrangement makes room for both expertise and execution. The outside team can organize, challenge, draft, coordinate, and keep momentum. The company can make the decisions, perform its controls, and stand behind what the audit says.
If you want help getting SOC 2 done and hire outside support to drive the project across the finish line, you have to commit to actually letting the driver drive.
Related reading: explore AskDegree solutions when you want a team that drives the project and not just the checklist, or use the Security Questionnaire Response Plan while customer promises are running ahead of the audit.
