Sample case study, fictional client
From stalled deals to a clean SOC 2 Type II report in nine months
Ledgerline had three enterprise contracts waiting on a SOC 2 report. Mara joined one day a week, ran the readiness program, and the report came back clean nine months after kickoff. All three contracts were signed within six weeks of it.
- Ledgerline, reconciliation software for finance teams
- 90 employees, Series B
- 8-month vCISO engagement with SOC 2 readiness
Before
Ledgerline grew from 30 to 90 people in 18 months. Three enterprise contracts were stuck in procurement because each buyer required a SOC 2 Type II report. The CTO had been handling security alongside engineering and had no more hours to give. The board had approved a full-time security hire, but the search was going slowly and the contracts could not wait.
There was also no vendor review process, no written incident response plan, and a set of security tools bought one at a time with no overall plan.
The work
Mara joined at one day a week, two during audit preparation, and took a seat in the weekly leadership meeting.
- Discovery, 2 weeks: mapped data flows, classified customer data, set the SOC 2 scope, and delivered a 12-page Discovery Document.
- Roadmap, 1 week: a 12-month plan with SOC 2 readiness first.
- Build, 12 weeks: wrote 14 policies, set up the compliance platform, closed missing controls, and added a security check to the deploy process.
- Validate, 4 weeks: mock audit, penetration test coordination, audit kickoff.
- Operate: Mara continues one day a month for quarterly reviews and the annual audit.
Results
- 9
- Months to Type II report
- 14
- Policies written
- 0
- Exceptions in the report
- SOC 2 Type II report delivered 9 months after kickoff, against a plan of 9 to 12.
- No exceptions in the report.
- All three waiting enterprise contracts signed within six weeks of the report.
- Ledgerline still works with Northstar one day a month.
“Mara sat in our Tuesday leadership meeting for eight months. By the time the auditor arrived, our engineers were answering the control questions themselves.”
Part-time CISO (vCISO)
Mara joins your leadership meeting every week, owns the security roadmap, and answers customer security questions for you.
Book a 30-minute fit call with Mara.
Tell her what is driving the work. If Northstar fits, you get a written scope and price within three business days.