Sessions · Advisor session
SOC 2 for Startups: What to Do First, What It Costs, and What Auditors Look For
Tuesday, November 3, 2026 · 11 AM–12 PM PST
About this session
SOC 2 is quickly becoming a requirement in enterprise sales. A larger customer asks for your report, and suddenly you need to understand controls, auditors, tooling and timelines, usually while still running the company.
In this facilitated Q&A, Marcus French from KBF, whose team runs SOC 2 audits and issues SOC 2 reports, walks through how the process actually works and what you can do now to get through it with as little pain as possible.
Topics may include:
What should we prioritize first, and what can wait?
Type 1 or Type 2: which one do we need, and when?
Which tooling (e.g. Vanta, Drata) makes sense at an early stage?
How long does it realistically take, and what does it cost?
What do auditors actually look for, and what are the most common mistakes?
Format
Each founder introduces themselves: name, company and their specific question
Marcus gives a short overview of the SOC 2 process
Open Q&A around the founders' questions
Please come with one concrete question about your SOC 2 process. What founders share stays in the room.
Why attend
- Know what to tackle first, and what can wait, before a customer asks for your SOC 2 report
- Decide between Type 1 and Type 2, and when each makes sense
- Get realistic numbers on timeline and cost, straight from a team that runs the audits
- Bring your own questions, in a small room built for a real conversation
Hosting this session
Marcus French
KBF
Marcus French works with KBF's SOC 2 team, which runs SOC 2 audits and issues SOC 2 reports for growing companies.
Next step
Have a question behind the session?
Share what you’re working through. If your company qualifies, we’ll reply personally within 24 hours.
For companies that have raised at least $1M from venture firms.