SOC 2 consulting clients are software and data companies that just lost, or are about to lose, a deal because a bigger customer asked for a security report they cannot produce. Find them by reading their websites and job posts for the signs, call the founder or head of engineering with a 20-minute readiness check, and hand over a gap list. The urgency is already there, so your job is to reach them while it is still a live deal.

What follows covers how this buyer thinks, the signals you can spot from outside, a call opener, a worked month, and the mistakes that cost consultants good prospects. You are the preparer, not the auditor, and the page is clear about that line.

What the buyer is actually buying

The American Institute of CPAs describes System and Organization Controls as a suite of services that CPAs provide, giving users the information they need to assess the risks of outsourcing a service. A SOC 2 examination is organized around five trust services categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is in every SOC 2; the other four are added when the company's customers need them, which is a scoping question you can help answer. A CPA firm performs the examination and issues the report. A consultant helps the company get ready for it.

That split matters when you sell. The founder is not buying an audit from you. They are buying a calmer path to the audit: which policies to write, which systems to log, who is responsible for each control, and a schedule they can hold the team to. Say that in one sentence and say who does the audit.

The people who sign are the founder at a company under 50 people, a CTO or head of engineering, or a head of security if one exists. A sales leader often raises the problem because a deal is waiting, so ask for an introduction when a salesperson is the first to reply.

Spot them before they call anyone

You can read a lot from a prospect's public pages in five minutes. A good prospect usually has most of these:

  • Enterprise or mid-market customer logos on the home page.
  • No security page, or one that says "SOC 2 in progress" or lists only a policy summary.
  • A recent funding round, usually seed or Series A, with a team of 15 to 80.
  • A job post for security, compliance or a first IT hire.
  • A product that stores customer data, such as HR, finance, health or marketing tools.

Score each company out of five. Contact the ones with three or more first. Related reading: how security providers find clients covers the broader market, and some of your best referrals come from firms in it.

Four channels that reach a deal-in-progress

  1. Outbound to scored prospects. A short email or a call, citing the specific signal you saw. This is your main source for the first six months.
  2. CPA firms that perform the examination. Contact two or three in your region or niche and ask whether they work with outside readiness consultants and how they would want a client introduced. Write down what they tell you instead of assuming.
  3. Startup lawyers, fractional CTOs and managed IT firms. They hear about the questionnaire first. A one-page summary of what you do and what a readiness engagement includes makes it easy for them to pass your name on.
  4. A narrow public guide. One checklist, such as "what a seed-stage HR software company needs before its first SOC 2", published on your own site and sent to prospects. It should be specific to one kind of company.

A call opener that fits the moment

"Hi, is this Ravi? Ravi, I'm Lena from Fieldstone Compliance. I was looking at Tallow Payroll's site and saw you list a few larger customers but no security report. I help software companies get ready for SOC 2, and I wondered whether a customer has asked you for one yet. If so, I can send you a one-page gap list in a day, and you can decide from there. Is this a bad time?"

The names are made up. The structure is not: name what you saw, ask one question about a live deal, offer a small deliverable, and give them an exit. If they say "not yet", ask what size customer would trigger it and write the date to check in again.

A worked month for an invented consultant

Say Lena runs Fieldstone Compliance alone and wants two readiness engagements by the end of the quarter.

  • Week 1: scores 100 software companies from a funding database and keeps the 30 with three or more signals.
  • Week 2: sends 30 emails, then calls the 10 founders with the clearest signals. Say 4 take a call and 2 ask for the gap list.
  • Week 3: writes the two gap lists, each one page, with the five biggest missing controls, an estimated number of weeks and the reports a CPA firm would ask to see.
  • Week 4: reviews both with the founders. One says a customer is waiting and signs. The other is two quarters out, so she notes the date and adds them to a monthly note.

This is a plan, not a prediction. The order is what carries over: signals first, a gap list second, the engagement third.

What to stop doing

  • Scare language about breaches. The buyer's trigger is a sales deal, not an attack. Talk about their deal.
  • Posing as the auditor. Say plainly that a CPA firm issues the report. Founders notice a blur and it costs you trust.
  • Leading with a tool. Software platforms are part of the work, but the buyer wants someone who tells them what to do on Monday.
  • Quoting before the gap list. You cannot price what you have not scoped.
  • Treating a no as final. A company that cannot afford it now will need it when the next big prospect appears.

Most of the weekly work is scoring companies and sending a patient sequence of notes. Rocketship can do the reading and the follow-up: tell it in plain words which kinds of software companies you want, it reads each one's site, finds the founder or head of engineering by name, emails from your Gmail, and books the call on your calendar. It will not do the gap list for you. See lead generation software for MSPs for a similar services setup, and pricing for what each plan covers.