If you've ever stared down a SOC 2 audit for the first time, you know the feeling: a sudden flood of evidence requests, a spreadsheet that seems to multiply overnight, and the creeping suspicion that your entire organization is one missing policy away from a findings report that nobody wants to write.

Here's the thing. SOC 2 doesn't have to be a crisis. It just usually feels like one.

After spending two years in the trenches helping MSPs guide their clients through compliance programs, and personally overseeing the process that earned Galactic Advisors multiple SOC 2 Type II reports, I've seen what separates the organizations that survive an audit from the ones that actually build something durable from it.
This session is a candid, experience-first walkthrough of what a SOC 2 audit actually looks like from the inside. Not the marketing brochure version, but the version where someone asks you for 18 months of access logs at 4pm on a Friday. We'll talk about how to build evidence collection habits that don't require a fire drill, how to communicate audit requirements to a team that didn't sign up to be compliance officers, and how to use the Trust Services Criteria as a blueprint for operational maturity rather than a checklist for auditors.

We'll also get honest about the emotional weight of the process. Audits create anxiety. They surface gaps. They can make a well-run organization feel like it's held together with duct tape. I'll share the frameworks that helped me (and the teams I worked with) reframe the audit as a strategic asset instead of a bureaucratic tax.
Attendees will walk away knowing how to scope a SOC 2 engagement without over-committing, how to keep internal stakeholders aligned throughout the audit cycle, and how to turn a clean report into a trust-building tool for clients and partners.