SOC 2 for SaaS: Pass Your First Audit with AI

This course contains the use of artificial intelligence.

Your biggest prospect just asked for your SOC 2 report.

You don't have one. Nobody at the company has been through an audit. The deal is now waiting on you, and every article you find explains what SOC 2 is rather than what you actually have to do on Monday morning.

This course is the other thing. It doesn't teach SOC 2 the way you'd study for an exam — it teaches the audit: the scoping decisions, the controls, the evidence, and the conversations you will genuinely have with your auditor.

How it works

Every Common Criterion, CC1 through CC9, gets the same treatment. What the control actually requires, in plain language rather than AICPA phrasing. How it looks at a real Series A SaaS company. And — the part most courses skip — the exact artifact an auditor will ask you to produce, and what makes them doubt it.

We work through the whole thing at RelayDesk, a 75-person B2B SaaS company on AWS with three enterprise deals blocked on a Type 1 report, no policies, no risk register, and one security engineer. If that sounds like your company, that's the point.

The companion app

A Next.js application ships with the course. You run it locally with your own free Gemini API key, set your company profile once, and it drafts:

• A code-of-conduct and tone-at-the-top policy (CC1.1)
• A risk register with scoring and treatment plans (CC3.2)
• An information security policy (CC5.1)
• An access control policy (CC6.1)
• An incident response plan (CC7.3)
• A vendor due-diligence checklist (CC9.1)
• A readiness gap assessment scored across every criterion in scope
• An evidence vault checklist with one row per control

Everything exports as a styled Word document naming your company, your leadership, and your stack — not a template with placeholders to fill in. Eight lectures show the app running end to end, unedited, so you can see exactly what it produces before you run it yourself.

To be clear about what the app is: it produces a first draft. The course spends as much time on the human work that turns a draft into evidence — the review, the approval, the signature, and the operating history — as it does on generating it.

What you'll finish with

Six hands-on assignments take you through the work itself: scoping your criteria, building and defending a risk register, reality-checking your access control policy against how access actually works today, running a tabletop against a Saturday-night breach scenario, tiering your real vendors, and turning a gap assessment into a 90-day plan. Each comes with a full worked solution, so you can compare your answers against a strong one.

By the end you'll have a complete first-draft control set, an evidence vault structured by criterion, and a dated remediation plan that gets you to fieldwork.

What this course does not do

It won't make you a CPA, and it won't get you certified — SOC 2 is an attestation performed by a licensed audit firm, and no course substitutes for that engagement. It covers one observation period rather than multi-year Type 2 renewals, and it mentions ISO 27001 and NIST CSF for comparison without mapping them in depth.

What it will do is get you from nothing to audit-ready without paying a consultant twenty thousand dollars to tell you what your policies should say.