Fractional CISO · SOC 2 · Roadmap

How a fractional CISO gets you SOC 2-ready — the real roadmap.

Sahil Dubey

CISA · AWS Solutions Architect Professional · 24 Jul 2026

SOC 2 stalls when policy lives in one universe and the AWS account in another. A fractional CISO who can do both compresses the timeline. Here's the week-by-week shape of it.

How long does SOC 2 take with a fractional CISO?

• Weeks 1–2 — Scope & gap assessment: pick Type 1 vs Type 2, define the Trust Services Criteria in scope, and map your AWS environment to the controls. Output: a prioritized remediation roadmap.
• Weeks 3–6 — Implement controls on AWS: IAM least-privilege + MFA, CloudTrail + Config org-wide, KMS encryption, Secrets Manager, GuardDuty/Security Hub, and change-management + CI/CD gates that satisfy CC7/CC8.
• Weeks 5–8 — Policies & evidence automation: the required policy set written to match what's actually running, plus AWS Config conformance packs so evidence collects itself.
• Weeks 8–14 — Readiness & audit: internal review, remediate findings, then auditor walkthrough. For Type 2, the observation window runs after — but it's uneventful because the work was front-loaded.

Who answers security questionnaires during SOC 2 prep?

Enterprise deals often can't wait for the final report. A fractional CISO builds a reusable answer library and a trust page so you can respond to customer and investor security questionnaires immediately — unblocking revenue while the audit proceeds.

Why does "compliant by construction" beat retrofitting controls?

When the person setting policy also architects the cloud, controls are built in from day one instead of bolted on before the audit. IAM maps cleanly to the criteria, CloudTrail satisfies CC7, and an assessor traces evidence in minutes — not weeks. That's the difference a CISA + AWS Solutions Architect Professional makes.

What happens after you pass the SOC 2 audit?

SOC 2 isn't one-and-done. The fractional CISO keeps the program alive between audits — quarterly evidence reviews, new-vendor risk, incident response, and next year's renewal handled without a fire drill.

Want to be SOC 2-ready without the fire drill?

A fractional CISO who builds the AWS controls and passes the audit. Book a free call.

Fractional CISO / vCISO →Book a free call

The opening month sets whether the rest of the programme is orderly or reactive, and almost none of it is writing policy.

Week one is inventory. What AWS accounts exist, who has access to them, what data lives where, and which third parties touch it. This is unglamorous and it is where the surprises are — a forgotten account with production data, a contractor whose access was never revoked, a SaaS tool processing customer records that nobody registered. You cannot scope an audit around infrastructure you have not enumerated.

Week two is scope. Which systems are in the audit boundary and which are demonstrably outside it. Scope discipline is the highest-leverage decision in the whole programme: every system inside the boundary carries evidence obligations for the life of the report. Getting this right saves more time than any tooling choice.

Weeks three and four are the gap list, ordered by effort. Not by severity — by effort. The goal is to reach a state where the observation window can start, and the fastest route there is closing everything cheap before starting anything expensive. Enforcing MFA and enabling CloudTrail across accounts takes an afternoon; rebuilding an access model takes weeks. Do the afternoons first so the window can open sooner.

The phrase gets used loosely. Concretely, during the observation window your systems must produce a continuous record that the controls operated — and that record has to exist without anyone remembering to create it.

Access reviews are the clearest example. The control is not "we review access"; it is "access was reviewed on a defined cycle, by a named person, with the outcome recorded, and exceptions actioned." If that happens in a meeting with no artefact, the control failed for audit purposes even though it happened in reality. The fix is trivial once you see it — a ticket, a signed export, a dated document — but only if it is established before the window opens rather than reconstructed after.

The same applies to change approvals, incident records, vendor reviews, backup restore tests and training completion. Each needs a durable artefact with a date. My strong preference is for evidence that falls out of systems people already use — git history, pipeline logs, CloudTrail, ticket state — because evidence requiring separate discipline is evidence that lapses in month four when everyone is busy.

This is why the observation window should not start early. A window opened before controls are genuinely operating accumulates exceptions, and every exception in the final report is something you explain to each prospect who reads it.

Four blockers account for most delays, and none of them are technical.

Nobody owns it. Security work distributed across a team without a named owner reliably loses to shipping. This is the actual argument for fractional leadership — not superior expertise, but a person whose job it is that this happens.

Scope keeps moving. Someone adds Availability because a customer mentioned uptime, then Confidentiality because it sounds reassuring. Each addition extends the programme and the cost. Decide scope once, on evidence of what buyers actually require, and hold it.

Policies describe a fictional company. Templated policies commit you to processes you do not run. Auditors test against what your policy says, so a policy claiming quarterly access reviews you do not perform manufactures a finding out of nothing. Policies should document what you actually do, tightened where genuinely needed.

The auditor was chosen last. Firms differ substantially in cost, pace and how they interpret criteria. Choosing late means accepting whoever has availability. Talk to two or three early, ask how they handle exceptions and what their evidence expectations are, and get the relationship established before the window opens.

A SOC 2 report covers a stated period and then expires. The next window typically begins where the last one ended, which means the day after issuance you are already generating evidence for the following report.

Teams that treat the audit as a project relax, controls decay, and the second audit is nearly as expensive as the first — with the added problem that decay shows up as exceptions rather than as gaps. Teams that treat it as an operating standard find year two substantially cheaper, because the evidence is a by-product rather than an exercise.

The practical difference is small and worth naming: a recurring calendar for access reviews and restore tests, alerting when a control stops reporting, and someone reviewing the evidence pipeline monthly rather than annually. That is perhaps a day a month, against an audit that otherwise costs weeks of engineering time to re-prepare.