/ CMMC Encryption Requirements: A Complete Guide for Defense Contractors

CMMC Encryption Requirements: A Complete Guide for Defense Contractors

Pedro Dias
March 30, 2026

The CMMC is vast in coverage and can easily become overwhelming. It includes 110 security controls for each level, excluding level 1, which has only 15, with many encryption controls required throughout.

This guide breaks down exactly what the four core encryption controls demand, how they apply across certification levels, and where assessors consistently find gaps that could have been caught months earlier.

Whilst most of these controls are straightforward, one stands out on the Defense Industrial Base Cybersecurity Assessment Center’s list of most commonly failed controls: SC.L2-3.13.11, which mandates FIPS-validated cryptography for protecting Controlled Unclassified Information (CUI).

This is not because it is technically complex. It is because most contractors misunderstand what it truly requires.

The mistake is almost always the same: assuming that using AES-256 is enough. It is not. CMMC encryption requirements are about validated modules, not algorithms, and that distinction is what fails organisations that believed they were ready.

What Are the CMMC Encryption Requirements?

CMMC 2.0 is the Department of Defense’s framework for verifying that contractors protect sensitive defense information. It operates on three certification levels:

Level 1, Basic protection of Federal Contract Information (FCI)
Level 2, Protection of CUI in alignment with NIST SP 800-171
Level 3, Protection of the most sensitive CUI against advanced persistent threats

Encryption requirements live primarily at Level 2 and above. With CMMC, the requirement for FIPS 140 validation now applies to every member of the Defense Industrial Base (DIB), an estimated 215,000 companies, that handles CUI. Every system that performs encryption and touches CUI must use FIPS-validated cryptography. That is a significant shift: previously, FIPS validation was largely reserved for vendors selling directly to federal agencies.

The timeline is active. The CMMC Acquisition Rule became effective November 10, 2025, with Phase 2, mandatory C3PAO assessments for Level 2 contracts, beginning November 10, 2026.

The 4 Core CMMC Encryption Controls Explained

Three controls form the backbone of CMMC’s encryption requirements. Understanding each one separately matters, because failing any of them has direct consequences on your assessment score.

Control	Name	What It Requires	Applies To
SC.L2-3.13.11	FIPS-Validated Cryptography	Cryptographic modules must hold a valid NIST CMVP certificate	Any system that handles CUI
SC.L2-3.13.8	CUI in Transit	Cryptographic mechanisms must protect CUI across all transmission channels	Networks, email, file transfers, APIs
SC.L2-3.13.16	CUI at Rest	CUI stored on any system must be encrypted	Servers, workstations, databases, backups
SC.L2-3.13.10	Cryptographic Key Management	Keys must be generated, stored, and revoked in a controlled, documented process	All systems using encryption to protect CUI
MP.L2-3.8.7.	CUI on Media	Encryption must extend to physical and removable media	USB drives, external disks, backup tapes, laptops

SC.L2-3.13.11: Employ FIPS-Validated Cryptography to Protect CUI

This is the headline control and the most misunderstood. A common mistake is confusing cryptographic algorithms with cryptographic modules. The CMMC requirement is about the module, not just the algorithm.

You can run AES-256 across your entire environment. If the module implementing it has not been validated through NIST’s Cryptographic Module Validation Program (CMVP), you are not compliant. The algorithm is not the certificate.

Pro Tip

During an assessment, you will be asked to provide the FIPS certificate number for each product that handles CUI, not a vendor’s claim that they “support AES-256.” Have those certificate numbers documented before the assessment starts.

SC.L2-3.13.8 and SC.L2-3.13.16: CUI in Transit and at Rest

SC.L2-3.13.8 requires cryptographic mechanisms to protect CUI during transmission, covering all communication channels: network connections, email, file transfers, and API communications. SC.L2-3.13.16 requires protection of CUI at rest. Neither control names a specific algorithm, but the FIPS validation requirement from 3.13.11 applies across both.

SC.L2-3.13.10: Establish and Manage Cryptographic Keys

Encryption without key management is security theatre. This control requires that keys be generated, stored, and revoked in a controlled, documented way. A compromised key renders all your encryption irrelevant regardless of algorithm strength.

MP.L2-3.8.7: Control Access to CUI on Media

This control extends encryption requirements to physical and removable media. CUI stored on a USB drive, an external hard disk, or a backup tape must be protected. Contractors who focus on network-level encryption and forget about the laptop bag sitting in a car park consistently fail this one.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

CMMC Encryption Requirements by Certification Level

Level 1 covers organisations handling only FCI. The controls are foundational and do not explicitly mandate encryption, though it remains a recommended practice. This changes sharply at Level 2.

Under the CMMC scoring methodology:

5 points deducted if no cryptography is employed
3 points deducted if cryptography is present but not FIPS-validated
Maximum score: 110 | Minimum passing threshold: 88

Getting SC.L2-3.13.11 wrong costs points you cannot afford to lose.

Level 3 introduces additional requirements aligned with NIST SP 800-172, including enhanced key management controls, stricter access controls on cryptographic infrastructure, and greater scrutiny of the supply chain around cryptographic tools.

Pro Tip

According to research by Merrill Research and CyberSheath, only 4% of defense contractors are fully prepared for CMMC certification based on third-party assessment criteria, while 75% believe they are compliant based on self-assessment. The gap is widest in technical controls, with encryption and key management among the most common failure points.

What Is FIPS-Validated Cryptography and Why Does It Matter?

FIPS stands for Federal Information Processing Standards. FIPS 140, developed by NIST, sets the benchmark for cryptographic modules intended to protect sensitive information. It requires that cryptographic modules be tested by accredited third-party laboratories and certified by NIST, a process managed through the Cryptographic Module Validation Program (CMVP).

FIPS 140-2 vs. FIPS 140-3

FIPS 140-3 is the newer standard, published March 22, 2019, and aligns with the international ISO/IEC 19790:2012(E) standard. Both remain acceptable under current CMMC requirements. FIPS 140-3 introduces stricter requirements around physical security, key management, and testing methodologies, and will likely become the primary standard as the framework evolves.

If your vendor holds a current FIPS 140-2 certificate and that module remains on NIST’s active modules list, you are covered for now, but plan your migration path.

Acceptable Encryption Standards Under CMMC

AES-256 is the most widely deployed algorithm in CMMC-compliant environments, and it satisfies cryptographic strength requirements when implemented through a FIPS-validated module. For data in transit, TLS 1.2 and TLS 1.3 support AES-256 cipher suites that meet the requirement. TLS 1.3 is the current best practice and should be your target configuration.

Pro Tip

Before your assessment, pull the FIPS certificate numbers for every product in your environment that touches CUI, your email platform, endpoint encryption, VPN, and cloud storage. Your assessor will ask for them. Having a documented inventory with certificate numbers and their active or historical status saves hours during evidence review.

Encrypting CUI at Rest for CMMC Compliance

Endpoints, Laptops, and Local Storage

Every device that stores CUI must have full-disk or file-level encryption enabled through a FIPS-validated module. In Windows environments, BitLocker is commonly used, but BitLocker in default mode is not FIPS-compliant. You must enable FIPS mode explicitly through Group Policy, and you must verify it is active, not just configured. Assessors will check both.

Removable Media and Hardware-Encrypted Devices

Removable media is one of the most consistent failure points across the DIB. A contractor can have bulletproof endpoint encryption and still fail this control because an employee transferred a CUI document to a personal USB drive. Hardware-encrypted USB devices with FIPS 140-2 Level 3 validation exist for this purpose. Controlling their use through both policy and technical enforcement is as important as choosing the right device.

Cloud Storage and FedRAMP-Authorised Infrastructure

FedRAMP Moderate and High authorisations include FIPS-validated cryptography by design. Microsoft 365 GCC High, AWS GovCloud, and Azure Government are the most commonly used platforms that meet this bar. Standard commercial tiers of the same platforms do not.

Note: Many contractors use a FedRAMP-authorised cloud platform and assume the encryption requirement is fully satisfied. It covers the provider’s infrastructure, not how users access it, what they download from it, or how they share files outside of it. The environment is FedRAMP-covered; the behaviour around it often isn’t.

Encrypting CUI in Transit for CMMC Compliance

Email Transmission of CUI

Standard email is not encrypted end-to-end. Your email might travel over a TLS-encrypted connection between mail servers, but that protects the transport pipe, not the message content. Secure email solutions that apply encryption to message content provide the protection CMMC requires for email containing CUI. Microsoft 365 GCC High with S/MIME or Office Message Encryption configured for CUI use cases addresses this. Standard Office 365 does not.

File Transfers and Collaboration Tools

SFTP and FTPS both support encrypted transmission, but implementations must use FIPS-validated cryptographic modules. Consumer file-sharing tools, even those marketed with encryption enabled, are almost never FIPS-validated. Dropbox, standard-tier Google Drive, and similar services are not acceptable for CUI transmission regardless of their encryption claims.

Remote Access and VPN Encryption

All remote access sessions that could expose CUI must use FIPS-validated encryption. Configure your VPN to enforce TLS 1.2 at minimum, disable older protocol versions, and document the configuration explicitly. When CUI leaves your physically controlled environment, cryptography is the primary protection mechanism, and that is precisely when FIPS validation becomes non-negotiable.

Encryption Key Management Under CMMC

Key Generation and Storage Requirements

Keys must be generated using approved random number generators within FIPS-validated modules and stored in a way that prevents unauthorised access. Hardware Security Modules (HSMs) are the gold standard. Software-based key stores within FIPS-validated environments are acceptable at Level 2, but your documentation must demonstrate the approach clearly.

Key Rotation and Revocation Best Practices

Define rotation intervals in your key management policy, and actually follow them. Rotate encryption keys when staff with key access leave the organisation. Have a tested revocation process. A policy that says “we rotate annually” but has never been executed will not survive an assessor interview.

Pro Tip

Document your key management lifecycle in your System Security Plan (SSP). Assessors are not just looking for functioning encryption, they are looking for documented, repeatable processes. A gap between what your SSP says and what you actually do is a finding, even if the technical controls are otherwise correct.

Common CMMC Encryption Deficiencies Found During Assessments

The Subcontractor Flow-Down Gap

Prime contractors invest heavily in their own encrypted environments, then allow subcontractors to access CUI through portals that lack proper encryption controls. Per 32 CFR Part 170, CMMC requirements flow down to subcontractors based on the type of data they process, store, or transmit. If your subcontractor downloads CUI to an unencrypted device, that exposure is your problem as much as theirs.

The Affirmation Window Vulnerability

Certified organisations must complete annual affirmations confirming ongoing compliance. Encryption configurations drift between assessments. A patch can disable FIPS mode. A new device can be deployed without the correct policy applied. Without continuous monitoring, the gap between your affirmed posture and your actual posture grows quietly, until the next assessor walks in.

Sensitive Bid Preparation Risks

CUI often flows early in a contract cycle, during proposal preparation and technical review, before formal compliance processes kick in. Contractors receive technical documents marked CUI, open them on standard workstations, email sections to colleagues, and store drafts on unencrypted shared drives. This is one of the most common real-world exposure scenarios, and it almost never appears in System Security Plans.

What a CMMC Assessor Will Look for on Assessment Day

Assessors examine documentation, configuration evidence, and staff interviews. For encryption specifically, expect requests for:

FIPS certificate numbers for each product handling CUI
Live demonstration that FIPS mode is active
Data flow diagrams showing how CUI moves through your environment and what encrypts it at each step
Key management logs showing actual rotation history, not just policy documents

Important: If minor gaps are identified during an assessment, organisations may address deficiencies within 180 days through a Plan of Action and Milestones (POA&M). Major issues require full reassessment. Encryption deficiencies attract close scrutiny and will affect your SPRS score for the duration of any POA&M period.

How to Remediate CMMC Encryption Gaps

Conducting an Encryption Gap Analysis

Map every location where CUI is stored, processed, or transmitted. For each data flow, identify the encryption method in use and verify whether the underlying module appears on the NIST CMVP active modules list. Document what is compliant, what requires remediation, and what requires a structural decision, some legacy systems need compensating controls or architectural changes rather than a direct fix.

A structured Encryption Gap Analysis is the most reliable way to surface these issues before an assessor does.

Implementing Per-File Encryption to Close Compliance Gaps

When full-disk encryption is not feasible, legacy embedded systems, manufacturing equipment, isolated lab environments, per-file encryption applied at the point of CUI creation or receipt can serve as a compensating control. The file travels encrypted regardless of where it is stored or how it is transmitted. This approach requires clear staff training and disciplined execution to be effective.

What CMMC Encryption Does Not Require

FIPS-validated modules are required when cryptography serves as your primary method of protecting CUI confidentiality, mainly when CUI leaves your physical control. When CUI stays within a physically secured boundary and physical controls provide the confidentiality protection, FIPS validation for internal network infrastructure is not mandated.

You do not need FIPS-validated switches, routers, or internal firewalls just because they carry traffic on a network that also carries CUI. This is a common and expensive misconception that sends contractors chasing requirements that do not apply to them.

Final Thoughts

Ready to find out where your encryption posture stands before an assessor does? Axipro works with defense contractors across the DIB to conduct pre-assessment gap analyses, identify FIPS compliance deficiencies, and build a remediation plan that holds up on assessment day. Get in touch to start the conversation.

What encryption algorithm is required for CMMC compliance?

CMMC does not mandate a specific algorithm by name. It requires FIPS-validated cryptography, and AES-256 is the most widely implemented algorithm that satisfies this requirement. The critical point: the cryptographic module implementing the algorithm must hold a current FIPS certificate.

Does CMMC require encryption at rest and in transit?

Yes. Controls SC.L2-3.13.16 and SC.L2-3.13.8 address at-rest and in-transit CUI respectively, and both apply at Level 2.

Is AES-256 sufficient to meet CMMC Level 2 encryption requirements?

AES-256 through a FIPS-validated module is sufficient. AES-256 through a non-validated implementation is not. The distinction matters enormously on assessment day.

What is the difference between FIPS 140-2 and FIPS 140-3 for CMMC?

FIPS 140-3, published in 2019, introduces updated testing methodologies aligned with ISO/IEC 19790. Both are currently acceptable under CMMC. FIPS 140-3 will likely become the primary standard as the framework evolves.

Do subcontractors need to meet the same CMMC encryption requirements?

Yes. CMMC requirements flow down through the supply chain. If a subcontractor processes, stores, or transmits CUI, they must meet the same encryption requirements as the prime contractor for that data.

Does using a FedRAMP-authorised cloud provider satisfy CMMC encryption requirements?

It satisfies encryption requirements for data within that provider’s authorised boundary. It does not address how users access, download, or share that data outside the boundary.

What happens if encryption requirements are not met during a CMMC assessment?

Unmet encryption controls result in score deductions and a finding in your assessment report. Minor gaps can be addressed through a POA&M within 180 days. Significant gaps may prevent certification until remediated, blocking contract eligibility during that period.

Axipro Author

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

March 30, 2026
All Blog, CMMC

Blog Highlights

Explore More Articles

ISO-27001

September 29, 2026

ISO 27001 Consultant vs. Software: Which Is Faster?

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

AI Security

September 27, 2026

Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

SOC-2

September 24, 2026

The SaaS Founder’s 6-Week SOC 2 Readiness Plan (Free Template)

You can get a SaaS company ready for a SOC 2 audit in six weeks, but you’ll feel every one of them. Most published timelines say three to six months. For a company with no project owner, no identity provider, and nothing written down, that’s about right. A cloud-native startup that already has the basics in place and can protect some time is a different story, and it can fit the work into six hard weeks. This plan walks through that route one week at a time. Each week has an owner, an hour estimate, and a clear test for when it’s finished. The free Google Sheet version turns the plan into a tracker you can hand out to owners and update in your weekly standup. Before you start, know what you’re signing up for. At the end of week 6 you’ll be audit-ready, which isn’t the same as holding a Type II report. Nobody can get you a Type II in six weeks. This is also the do-it-yourself route, and it takes a lot of hours. We’ll show you where those hours go and what the faster option looks like. Is Six Weeks Realistic for Your Company? Six weeks works when most of the plumbing already exists and your job is to formalize it, fill the gaps, and prove it all works. It falls apart when you’re building the foundations and documenting them at the same time. Go through this table honestly before you promise a customer a date. Six weeks is realistic if… Plan for 10 to 16 weeks if… Your product runs on a major cloud provider You host on-premise or across several data centers You already use an identity provider with SSO Every tool has its own login and password You have fewer than about 50 employees You have multiple offices, subsidiaries, or products in scope One named person owns the project with 10 to 15 hours a week Compliance is “everyone’s job,” so in practice nobody owns it An engineer can give you 15 to 20 hours in weeks 3 and 4 Engineering is fully committed to a launch You only need the Security criteria You need Availability, Confidentiality, or Privacy on day one Landing mostly in the right-hand column doesn’t mean you should throw the plan out. Give each week two weeks instead of one and follow the same order. What “SOC 2 Ready” Means at the End of Week 6 SOC 2 doesn’t give you a certificate. An independent CPA firm examines your controls against the AICPA Trust Services Criteria and writes a report, and which of the two report types you go for decides what you can show a buyer after week 6. A Type I report checks whether your controls are designed properly on a single date. Once you’re ready, a Type I audit can start almost right away. A Type II report checks whether those controls kept working over an observation period of at least three months, and usually six to twelve. Most enterprise procurement teams want Type II in the end. Being “ready” at the end of this plan means your in-scope controls are in place, you can pull evidence for any of them on request, and your auditor is booked. From there you either start a Type I audit or open your Type II observation window. Plenty of buyers will sign with a Type I report plus a letter from your auditor saying the Type II period is underway. Important: The Type II clock doesn’t start until your controls are running. If readiness slips by a week, your Type II report slips by a week too. Founders who tell a prospect “we’ll have SOC 2 in Q3” often forget this and end up renegotiating the deal. Before Week 1: Four Decisions to Make First Settle these before the clock starts. If you change any of them halfway through, you’ll redo work. Scope. Decide which systems, teams, and data the report covers. For most SaaS companies that’s the production environment, the code repository, the identity provider, customer data stores, and any support tools that touch customer data. Corporate systems that never see customer data can usually stay out. Trust Services Criteria. Security (also called the Common Criteria) is mandatory. Availability, Confidentiality, Processing Integrity, and Privacy are optional. Report type. Pick Type I if a deal is blocked right now and the buyer will accept it. If there’s no deadline, go straight to Type II. You’ll need it eventually, and skipping Type I saves you an audit fee. Owner and tooling. Name one person who’s accountable for the plan, and decide where your controls and evidence will live. The tooling choice gets its own section below. Pro Tip: Adding Criteria Only add optional criteria when a customer contract or security questionnaire asks for them. Each one brings more controls to set up and more evidence to collect, and you can widen the scope in next year’s audit. Spreadsheet or Compliance Software: Choosing Your Tracking Tool Every SOC 2 program needs a system of record, meaning one place where each control, its owner, its status, and its evidence live. You can run it yourself in a spreadsheet or a GRC platform, or have a consultant implement it for you. The right choice depends mostly on which report you’re after and how much of your team’s time you can spare. A spreadsheet is free and familiar. It also makes you understand your own environment before you automate any of it. For a Type I, or for a small team with a tight scope, a well-built spreadsheet can take you all the way to the audit. Axipro’s free GRC workbook for SOC 2 and ISO 27001 covers all 33 SOC 2 Common Criteria plus the optional criteria, with evidence, risk, policy, and gap trackers built in. It has no macros and opens straight in Google Sheets or Excel. A GRC platform connects to your cloud, identity provider, code repository, and HR system.