SOC 2 Without a Security Team: Who Owns What, and How to Keep It Running

Short answer: You can get and keep SOC 2 without a security team if you give every control a named owner, run a fixed weekly, monthly, quarterly and annual review cadence, automate evidence collection, and keep human judgment for risk, access and incident decisions. One founder or the CTO is accountable overall. Outside help fills gaps, but cannot own the program.

Related guides:

• SOC 2 for startups
• Maintaining SOC 2 compliance after your first report
• Your first security hire

Key takeaways

• SOC 2 does not require a security department. It requires controls that are designed, operated and monitored. Those can be spread across people who already work at your company.
• One person is accountable. Usually the CTO or a technical founder. Everyone else owns specific controls.
• Cadence beats heroics. A short weekly check and a monthly review keep you audit ready far better than a scramble before fieldwork.
• Automate the collection, not the judgment. Tools can gather evidence and flag drift. People still decide on risk, access and exceptions.
• Your auditor cannot run your program. AICPA independence rules stop the CPA firm from taking on management responsibilities for you.
• Outside help is a bridge. A vCISO or MSSP can cover expertise or monitoring gaps until the workload justifies a hire.

---

Who owns SOC 2 at a startup without a security team?

At a startup, SOC 2 is owned by one accountable leader, usually the CTO or a technical founder, with individual controls assigned to whoever already runs that part of the business.

SOC 2 examinations are reported against the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022). The Security category is built on nine common criteria series: CC1 Control Environment, CC2 Communication and Information, CC3 Risk Assessment, CC4 Monitoring Activities, CC5 Control Activities, CC6 Logical and Physical Access Controls, CC7 System Operations, CC8 Change Management and CC9 Risk Mitigation. None of these names a security team. They describe what has to happen, so you can map each one to a person who already does that work.

Here is a starting split that, in our experience, works for many small SaaS and HealthTech companies. Adjust it to your org chart.

Area (TSC series)	Founder / CTO	Engineering lead	Ops / people lead	External CPA auditor
Program ownership, policies, board reporting (CC1, CC2)	Accountable	Consulted	Responsible for policy acknowledgments	Informed
Risk assessment and vendor risk (CC3, CC9)	Accountable	Responsible for technical risks	Responsible for vendor reviews	Informed
Monitoring and deficiency tracking (CC4)	Accountable	Responsible	Responsible	Tests, does not perform
Access control, MFA, access reviews (CC6)	Accountable	Responsible	Responsible for joiner and leaver steps	Tests
Logging, alerting, incident response (CC7)	Accountable	Responsible	Consulted	Tests
Change management, code review, deploys (CC8)	Informed	Responsible and accountable	Not involved	Tests
Security training, background checks	Informed	Consulted	Responsible and accountable	Tests

Two rules keep this working. First, every row has exactly one accountable name, not a team. Second, the accountable person signs off on the evidence for their row each quarter, so ownership shows up in the record and not just on a slide.

What does a weekly, monthly, quarterly and annual SOC 2 cadence look like?

A workable cadence is a short weekly check, a monthly review, a quarterly control sign-off and an annual reset, each with a fixed owner and calendar slot.

CC4.1 in the Trust Services Criteria says the entity "selects, develops, and performs ongoing and/or separate evaluations" of its controls, and CC4.2 covers evaluating and communicating deficiencies in a timely manner. A recurring cadence is the simplest way to show both. The time estimates below are examples, not requirements.

Weekly (engineering lead, about 15 to 30 minutes)

• Triage failing automated checks, such as a storage bucket that became public or a user without MFA.
• Review security alerts and decide whether any qualifies as an incident.
• Confirm that open high-severity vulnerabilities have an owner and a date.

Monthly (engineering lead and ops lead, about an hour)

• Reconcile HR records against identity provider and cloud accounts. Every leaver should be fully removed.
• Review patching and dependency updates against your vulnerability policy.
• Check that backups ran and spot-check one restore.
• Log any control that failed and the fix, so deficiencies have a paper trail.

Quarterly (founder or CTO chairs, about two hours)

• Run user access reviews for production, cloud consoles and critical SaaS tools.
• Each control owner signs off that their controls operated, with exceptions noted.
• Review new vendors and any vendor that changed how it handles your data.
• Update the risk register for new products, customers or infrastructure.

Annual (founder or CTO, spread over a few weeks)

• Formal risk assessment and policy review, with leadership approval.
• Security awareness training for all staff and an incident response tabletop exercise.
• Penetration test if your customers or your own risk assessment call for one.
• Prepare for the audit window: confirm scope, system description and the evidence list with your auditor.

For more on staying in shape between reports, see our guide to maintaining SOC 2.

Which SOC 2 tasks can you automate, and which need a human?

Automate anything that is a repeatable fact about a system, and keep humans on anything that requires judgment, approval or accountability.

Automate	Keep human
Collecting configuration evidence from cloud accounts	Deciding which risks to accept and why
Checking MFA, encryption and logging settings continuously	Approving access and reviewing whether it is still needed
Detecting devices without disk encryption or screen lock	Declaring and running an incident
Flagging leavers who still have accounts	Approving exceptions to policy
Scanning code for leaked secrets and vulnerable dependencies	Assessing a new vendor's fitness for your data
Reminding owners about due reviews and training	Signing off that a control operated

The pattern is simple: tools generate signals, people make decisions, and the decision is recorded. An auditor testing an access review wants to see that someone with the right authority looked at the list and acted on it, not just that a report was produced. Automation also removes the most common failure at small companies, which is evidence that was never captured because the person who knew how to capture it was busy shipping. If you are weighing tooling, our explainer on continuous monitoring explains how automated checks feed your monitoring activities.

Can your SOC 2 auditor help you build the program?

Only within limits, because your SOC 2 auditor must stay independent of the controls it is testing.

SOC reports are, in the AICPA's words, "a suite of service offerings CPAs may provide" on the controls of a service organization, as described on its SOC suite of services page. Because a SOC 2 is an attest engagement, the CPA firm must be independent. The AICPA's Plain English Guide to Independence says members may not assume management responsibilities for an attest client, and that when a firm does provide permitted nonattest services, the client must oversee them by designating an individual, preferably within senior management, who has suitable skill, knowledge and experience.

In practice that means:

• Your auditor will not design, run or own your controls. Do not expect it to write your policies or operate your access reviews.
• Someone inside your company must be able to oversee the work. That is another reason the founder or CTO should stay accountable, even if consultants do much of the setup.
• Readiness help may come from a separate firm. If you want hands-on help building controls, many companies use one advisor for readiness and a different CPA firm for the audit. Ask any firm offering both how it addresses independence.

When does a vCISO or MSSP make sense?

Bring in outside help when you lack a specific skill or round-the-clock coverage, not to hand off accountability.

The two most common options are different tools for different gaps:

Option	What it covers well	What it does not replace
Fractional or virtual CISO (vCISO)	Risk assessment, policy writing, security roadmap, customer security calls, board updates	Day-to-day operation of your controls, internal accountability
Managed security service provider (MSSP)	Monitoring alerts outside business hours, triage, escalation	Access reviews, change management, vendor decisions

A vCISO often makes sense when enterprise or healthcare buyers want to talk to a named security leader, or when nobody internally feels confident running a risk assessment. An MSSP often makes sense when your incident response plan promises a response time your team cannot meet overnight. In both cases, write the scope down, keep the provider's work inside your evidence trail, and treat their reports as inputs to your quarterly sign-off, not substitutes for it. If you handle protected health information, also check whether the provider will touch it and needs a business associate agreement.

What are the signs it is time to hire security?

It is time to hire when security work keeps displacing roadmap work, or when the risk to your customers grows faster than your part-time owners can manage.

Watch for these signals:

1. Control owners miss the cadence. Weekly checks slip to monthly, and quarterly reviews start late.
2. Security questionnaires pile up. Sales cycles wait on answers only one engineer can give.
3. Scope is expanding. You are adding frameworks such as ISO 27001 or HIPAA, new regions or new product lines.
4. Outside spend is climbing. Your vCISO and MSSP hours are rising quarter over quarter.
5. An incident or near miss exposed a gap. Nobody had time to run the playbook properly.
6. Customers ask for a named security leader in contracts. A fractional arrangement may stop being enough.

Two or more of these, sustained over a couple of quarters, is a good prompt to plan the role. Our first security hire guide, linked above, covers which role to hire first and what the first 90 days should deliver.

How SecureSlate helps

SecureSlate gives small teams the structure that a security department would otherwise provide:

• Control mapping and ownership. Built-in SOC 2 controls mapped across frameworks such as ISO 27001, HIPAA and HITRUST, with custom controls for anything specific to your business.
• Automated evidence. Agentless, read-only cloud integrations and a device agent check configurations continuously and flag drift.
• Access reviews. Run quarterly reviews with recorded approvals and revocations.
• Vendor and risk management. Keep the risk register and vendor reviews in one place, tied to owners and due dates.
• Code security and secrets detection. Catch leaked credentials and risky dependencies in your repositories.
• Audit management, trust center and questionnaire automation. Share your posture with buyers and answer security questionnaires without pulling engineers off the roadmap.

Start your SecureSlate trial to assign owners and set up your cadence.

FAQ

Can a startup get SOC 2 with no security team?

Yes. SOC 2 asks for controls that meet the Trust Services Criteria, not for a dedicated security department. A founder or CTO stays accountable, existing staff own individual controls, and automation plus a fixed review cadence keeps evidence current.

Who should own SOC 2 at a startup?

Usually the CTO or a technical founder. They have authority over systems and budget, and they can oversee outside providers. The engineering lead and an ops or people lead typically own most individual controls.

Can our SOC 2 auditor also set up our controls?

Not in a way that compromises independence. AICPA independence guidance prohibits a CPA firm from assuming management responsibilities for an attest client. Many companies use a separate advisor for readiness and ask their audit firm how it handles independence.

Do we need a vCISO for SOC 2?

Not necessarily. A vCISO helps when you need risk expertise or a named security leader for customers. Many small teams operate SOC 2 without one, as long as owners follow the cadence and decisions are documented.

How much time does SOC 2 take each week without a security team?

It depends on your scope and tooling. In our experience, teams with automated evidence collection keep the weekly check short and concentrate effort in the monthly and quarterly reviews. Track the hours yourself, since rising hours are one of the signals to hire.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.