How long does SOC 2 take?

SOC 2 Type I: 3-4 months from starting the process. SOC 2 Type II: 9-12 months (6 months minimum audit observation period + audit itself). Start early — enterprise deals will ask for it, and "we're working on it" doesn't unblock procurement.

Do we need a General Counsel?

Not until $20-30M ARR. Below that, a fractional GC or contracts specialist (part-time, 10-20 hrs/week) handles enterprise contracting. Above that, a full-time in-house counsel becomes the bottleneck-breaker.

What's the biggest enterprise readiness mistake?

Waiting until the first big deal is on the table to start SOC 2. It adds 6-12 months to that deal (or kills it entirely) because auditors can't be rushed. Build ahead of the pipeline, not in response to it.

Enterprise Readiness for B2B Startups: The 2026 Checklist

Enterprise deals require security, compliance, contracting, and support infrastructure most startups underestimate.

Enterprise Readiness: What You Need Before Selling $100K+ ACV Deals

Selling into enterprise ($100K+ ACV, Fortune 2000 buyers) requires infrastructure most startups don't have when they land their first big logo. Security reviews, procurement, master service agreements, SOC 2, SSO, audit logs, custom SLAs — the checklist is 40+ items long, and missing any one of them can add 60-90 days to a deal cycle. The startups that scale into enterprise didn't wait for the first big deal to build this; they invested 6-12 months ahead of it.

The security & compliance stack

SOC 2 Type II (Type I is a stepping stone; enterprise buyers ask for Type II — 6-12 months of audit history). ISO 27001 for international deals (EU, APAC). HIPAA if selling into healthcare. PCI-DSS if handling payments. GDPR + CCPA compliance for any consumer data. A published security page (yourcompany.com/security) with certifications, sub-processor list, and DPA download. Total investment: $30-100K/year on tooling (Vanta, Drata, Secureframe) + audit fees ($15-40K/year).

The product feature checklist

SSO/SAML (Okta, Azure AD, Google Workspace at minimum). SCIM provisioning (automated user creation/deprovisioning). Audit logs (who did what when, exportable to SIEM). Role-based access control (RBAC) with custom roles. Data export / API access. Data residency options (EU, US regions minimum). Custom retention policies. IP allowlisting. These are table stakes above $50K ACV. Missing any one blocks 20-40% of enterprise deals.

The legal & procurement stack

MSA template (your paper) with negotiable schedules. Standard DPA (data processing addendum). BAA (business associate agreement) if healthcare. Insurance certificates (cyber liability, E&O, general liability — usually $2-10M policies). W-9 / vendor onboarding docs. Procurement portal profile (Ariba, Coupa, common ones enterprises use). Redlines process: your GC (or fractional GC) can turn a redline in 3-5 days, not 3-5 weeks. Slow legal loses deals.

The support & success infrastructure

Named CSM assigned at contract signature. 24/7 support option (usually a paid add-on for $50K+ ACV). SLA commitments (99.9% uptime standard, 99.95% for critical customers). Status page (public and honest). Executive sponsor program (CEO/CPO/CRO available for QBRs with strategic accounts). Enterprise buyers pay a premium for confidence — and cut budget the moment they lose it.

When to invest

$1M ARR: not yet — you'll burn cycles on infrastructure for deals you can't close. $3-5M ARR: start SOC 2 Type I, publish security page, add SSO. $5-10M ARR: complete SOC 2 Type II, add SCIM + audit logs, hire first enterprise CSM. $10-20M ARR: ISO 27001, dedicated enterprise support, data residency, procurement optimization. Companies that build all this before $3M ARR waste resources; companies that wait until $15M ARR lose 12 months of enterprise deals to competitors who did.

Frequently asked questions

How long does SOC 2 take?: SOC 2 Type I: 3-4 months from starting the process. SOC 2 Type II: 9-12 months (6 months minimum audit observation period + audit itself). Start early — enterprise deals will ask for it, and "we're working on it" doesn't unblock procurement.
Do we need a General Counsel?: Not until $20-30M ARR. Below that, a fractional GC or contracts specialist (part-time, 10-20 hrs/week) handles enterprise contracting. Above that, a full-time in-house counsel becomes the bottleneck-breaker.
What's the biggest enterprise readiness mistake?: Waiting until the first big deal is on the table to start SOC 2. It adds 6-12 months to that deal (or kills it entirely) because auditors can't be rushed. Build ahead of the pipeline, not in response to it.

Related fundraising guides (40)

Investor directory · Fundraising library · Articles A–Z · Company funding database