SOC2 is an industry signal that you are committed to security, and it is table stakes for an enterprise SaaS vendor (deals >$100k). It is not relevant if you are actually committed - it's the signaling that counts. The fact that you got large customers without it means you are either lucky, sold based on prior warm relationships, or the client was negligent bordering on incompetent. Either way, congratulations - it's a good problem to have as long as you charge accordingly.<p>First, some wrong answers:<p>1. "Here is the AWS SOC2 report". Your cloud provider is just a vendor, and sending your vendors' boilerplate is unrelated to your security posture. Saying this will signal that you don't know what SOC2 is, or what they are asking for, and everything you say after this will fall on deaf ears.<p>2. "We don't have this as we focus on innovation and speed". For infosec people, this is the same as an aspiring F1 racer saying they never got a driving license for those reasons.<p>3. "We are small, and we don't need this for our operations". This is also a signal: there is no documented knowledge, repeatable processes, backups, worker redundancy, risk management, or any operational planning. "Now, can we have your data?"<p>If you accept SOC2 as a necessary evil in your new life, you'll need to set aside ~$30k and 100 hours over the next six months to get a Type 2 (there is no "certificate" for SOC2, that's not a thing). The absolute minimum would be four months, and for first-timers, it might take 8-10 months.<p>But we're talking about a signal here - to show that you take security seriously. One right answer could be something like this - "At StartupCo, we are deeply committed to information security. Our customers trust us with sensitive data because we designed our ISMS based on the industry's best practices and recommendations from CIS and NIST. Our infrastructure is designed around on the principle of the least privilege at every level - firewall rules, network permissions, server configuration (based on CIS Level 2 benchmarks), IT user accounts, and even our internal Wi-Fi routers. We encrypt all data at rest with AES-128, and in motion with TLS. All data access, including admin access, is logged off-site, and our IDS/IPS systems automatically report any unexpected activity. Next on our ISMS priority list is to engage external auditors to obtain 3rd party attestations, starting with SOC2. In our current schedule, we plan to receive the Type1 report in Q1, followed by Type2 in Q3".<p>Assuming your operations are sound and everything you claim is true, this will give the big company a clear signal that you understand security. You are committed to this. You have a clear pathway to external validation, and they have plausible deniability.<p>As much as startups boast about scaling, Enterprises do things "at scale" by default. The only way that works if you have clear rules, and your people follow those rules. "Require SOC2" one of those rules. It's not a bug; it's a feature that discloses which players understand the game. Play by their rules, get paid.