Just wanted to +1 this comment and say Vanta made SOC2 way more intimidating than it was.

What made it easy was talking to a startup that wanted soc2 and had it themselves who recommended an auditor who helped us untangle what was actually required.

It took a couple of months to get type 1 from start to finish with very part time attention.