A customer won't buy until you're SOC 2. Get ready in days.

Information Security, Acceptable Use, Access Control, Change Management, Incident Response, Vendor Management, Business Continuity, Data Classification. Each mapped to specific Trust Services Criteria with your company details spliced in.

The SOC 2 Section 3 draft your auditor reads first to set scope, a Statement of Applicability covering every Trust Services criterion, and an asset register and data inventory grounded in your stack answers. Consultants charge four figures for the system description alone.

Thirty-three rows from CC1.1 to CC9.x in AICPA filename convention, each naming the artifact an auditor accepts, the fields it must show, and the exact console or CLI path that produces it. The gap memo reads the index and ranks what to close before fieldwork, with one concrete next action per gap.

Branch protection, MFA enforcement, encryption at rest, backups, and the rest, each with objective, procedure, and expected result, written the way an auditor reads them. On the soc2.zip AWS tier they arrive pre-verified against your account from a read-only scan, not as homework. Plus a scoping brief that makes your annual pen test usable as audit evidence.

Quarterly access reviews with the exact AWS export commands, a vendor register with review log and CUEC worksheet, onboarding and offboarding checklists whose completed copies are the audit evidence, three scripted incident tabletops, a training kit with quiz and roster, and a change-management population export. The 12-month calendar is dated to your fieldwork target: a backward-planned sprint when you book a Type 1, quarterly anchors for a Type 2, so you get real dates instead of "quarter 1." This is the layer first audits actually fail on.

What keeps a stalled deal moving before your report exists: a self-contained security page you can publish at yoursite.com/security the same day, all 138 cells of the CSA questionnaire answered against a defensible small-SaaS posture, sixty more pre-written answers for the SIG-Lite requests procurement sends, a SOC 2 to ISO 27001 crosswalk, and a SOC 2 Readiness Statement your leadership forwards to the prospect: current posture, the auditor you engaged, and a target report date. New for the questionnaires 2026 buyers actually send: an AI security posture summary that lists your approved AI tools, the rule that keeps customer data out of them, and each LLM vendor's data-handling status for you to confirm and forward.

A starter risk register pre-scored on the standard 5x5 scale with treatments mapped to a curated mitigation library and a management-review minutes template, plus three audit firms hand-picked for your size, stack, and deadline, with cost ranges and a ready-to-send intro email for each. We run the auditor directory; the matches are real.

Drop the package in your repo and point Claude Code or Codex at it: recipes for filling the flagged placeholders from your codebase and AWS account with a cited source per fill, running the quarterly access review, and drafting questionnaire answers. In our benchmark, an agent pointed at AGENTS.md and a real buyer codebase closed 25 facts in 7 minutes, each with a cited source and zero fabricated citations. The guardrails forbid fabricated evidence; every artifact keeps its human sign-off.