First-Year Compliance Roadmap for a US Start-up

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

What you get. A twelve-month plan that puts the right evidence in front of each US buyer and investor at the moment they ask, prepared and run for you by Sterling.

A first-year roadmap is a sequence, not a shopping list. Chase every framework at once and a small team stalls; wait for a deal to demand a report and you rush. Three questions set the order:

• Who are your next twenty US customers? In Sterling's experience, US software buyers most often want a SOC 2 report; international and some regulated buyers lean to ISO/IEC 27001.
• Who will examine your controls, and when? A lead investor, an acquirer, or an enterprise vendor-risk team.
• What data do you hold? Health information brings HIPAA, payment cards bring PCI DSS, and an AI product brings AI governance questions.

The plan below assumes a cloud-hosted B2B software start-up with a small team. It is Sterling's planning view, not a regulatory timetable.

Quarters are indicative; shift them to match your US deal calendar.

What you get. Decisions made in weeks, with Sterling drafting the paperwork.

1. Free gap assessment. Shows where you stand against the standard your US pipeline needs first, so no effort is wasted. 2. Scope. The product and cloud environment customers depend on, and nothing more. A tight, accurate boundary is faster to evidence and cheaper to maintain. 3. Foundations. Single sign-on, multi-factor authentication, managed devices, encrypted storage, role-based access, a reviewable change process, and an inventory of systems and vendors touching customer data. Almost every US security review checks these. 4. Short policies that match practice. Auditors test what policies say, so we write what you really do. Name owners and a security lead, and start awareness training. Effivity, Sterling's GRC automation platform, comes with a full-year subscription, and Sterling Academy adds complimentary awareness training for your people.

What you get. Controls running for real, with a trail an examiner can test.

• Routine evidence. Access reviews on schedule, changes through approval, vendors assessed before they get data, joiners and leavers handled the same way every time.
• Outside view. The vulnerability assessment included in Sterling's information-security engagements shows how you look from the internet, and findings are tracked to closure.
• Internal audit. Problems surface while they are cheap to fix. The people who consulted on your system never audit it.
• Type 1 only on demand. If a named US customer needs something before a full report, consider a SOC 2 Type 1, then start the Type 2 period straight after. See SOC 2 Type 1 vs Type 2.

What you get. Shorter security reviews while your SOC 2 Type 2 period runs.

A Type 2 examination covers a period, and that period must finish before the CPA firm can report on it. Steady operation is the task. Use the quarter to remove friction from US deals:

• Trust center. Let buyers self-serve policies and summaries; follow the trust center checklist.
• Answer library. Repeat questionnaires take hours instead of days; see answering security questionnaires.
• Sales wording. "Examination under way, ending [month]" is accurate. Never call a SOC 2 report a certificate.
• ISO/IEC 27001 decision. If international customers or a procurement rule call for it, most controls already exist; the extra work is the management system layer. Our guides to ISO 27001 cost and ISO 27001 timeline help you decide.

What you get. A SOC 2 Type 2 report and a funded plan for the next year.

The period ends, evidence is assembled, and the examination completes. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require. SOC 2 sits within the AICPA's SOC suite of services delivered by CPAs^[1] and examines controls relevant to security, availability, processing integrity, confidentiality or privacy^[2].

Then three planning jobs:

1. Year two. The next SOC 2 period and any ISO surveillance or recertification audits, billed in the year they fall due. 2. Scope check. A new product line or region changes the boundary. 3. Management review. Leadership looks at incidents, audit results, risks and resources, and sets priorities.

Add these when a US contract, regulator or buyer requires them; each reuses the same baseline.

• HIPAA. Federal rules define a business associate as a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function^[3]. If that describes you, expect US health customers to want business associate terms and evidence of safeguards. Sterling offers HIPAA compliance consulting and an independent HIPAA assessment.
• PCI DSS. If you store, process or transmit payment-card data. PCI DSS is quoted separately: a fixed quote follows a free gap assessment.
• ISO/IEC 42001. If you build or deploy AI and US buyers ask about AI governance.
• ISO 9001. If a contract names a quality management system.

This is Sterling's recommendation, not a requirement of the AICPA, ISO or any investor.

1. Run the free gap assessment in month one, before choosing anything else. 2. Do SOC 2 first if most buyers are US businesses; consider ISO/IEC 27001 second. 3. Take a Type 1 only when a named buyer needs it, then start the Type 2 period at once. 4. Keep one control set and map every later standard to it. 5. Plan people time: a named owner for a few hours a week, an engineer for configuration questions, and leadership for approvals. Slow internal replies cause more delay than anything else. 6. Hold a management review at year end and write year two from it. Using a compliance tool already? Our tool vs consulting guide shows what remains.

Want this year mapped to your own US pipeline? Get a proposal from Sterling.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• HIPAA: standard overviewStandard overview
• PCI DSS: standard overviewStandard overview
• Pass US Investor Due Diligence on Security, FastUnited States
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• SOC 2 for Series A: What Founders Need and WhenUnited States
• SOC 2 Type 1 vs Type 2: Which Report US Buyers ExpectUnited States
• ISO 27001 Cost for US Start-ups: What You Pay and What Drives ItUnited States
• ISO 27001 Timeline for US Companies: How Long Certification TakesUnited States
• Trust Center Checklist for US SaaS and Start-upsUnited States
• Sterling in the United StatesUnited States

1. System and Organization Controls: SOC Suite of Services. AICPA & CIMA. accessed October 23, 2026.

2. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 23, 2026.

3. 45 CFR 160.103, Definitions (business associate). eCFR, National Archives. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.