Picture the scene twelve weeks before the roadshow. Bankers in the room, draft S-1 on the table, and the underwriter’s associate is asking for a SOC 2 Type II report dated within the last six months. The CISO’s calendar is the only honest document in the building, because the calendar shows that the CISO has been quietly pretending the audit is the certification the CISO can knock out in thirty days, and the calendar shows that the CISO is wrong. The pre IPO audit sits as the test the CISO has been quietly preparing for since the Series B closed, and a separate test the underwriter has been quietly preparing for since the roadshow was announced. The two preparations look nothing alike.
Here is the working version of the field guide. The shorter version is the part the CISO and the executive team actually have time to read.
What the audit actually covers
SOC 2 Type II is the floor. Auditors produce it on a rolling twelve month observation window, which means a Q4 IPO filing needs a SOC 2 that covers the back half of the prior year and the first half of the current one. Most CISOs discover this roughly fourteen weeks before the roadshow, when the auditor explains that a thirty day sprint will not produce a Type II report because the Type II report is the one with evidence across a full window. Type I, which is point in time, is faster and is also the report the underwriter will quietly downgrade in the diligence memo.
ISO 27001 is the European angle. A meaningful share of enterprise deals in EMEA, particularly in financial services and critical infrastructure, will not sign a vendor that ships without a current ISO 27001 certificate. Some will accept SOC 2 as a substitute. Most will not. The certification takes nine to fifteen months from a clean starting point. The CISOs who wait until the IPO window opens to start the ISO 27001 work are the CISOs who quietly drop the EMEA pipeline and pretend the choice was strategic.
Penetration test is the proof the underwriter is most likely to ask about. The auditor produces a report, the underwriter asks to see the report, and the engineer who actually wrote the report can be in the room when the engineer explains the report. The CISO who has been quietly hoping the CISO will pass the pen test without being asked about the pen test is the CISO who finds out, in the diligence call, that the underwriter sends the engineer’s own test team to validate the test. Mature programmes know this. Less mature ones are surprised by it.
What the CISO should actually do
Run a readiness assessment in the first ninety days after the S-1 filing intent is communicated. Not a vendor sales deck. A proper gap analysis against the SOC 2 trust services criteria, the ISO 27001 Annex A controls, and the pen test scope the underwriter is most likely to commission. The output is the working list of gaps the CISO will close in the months before the audit. The CISOs who skip this step are the CISOs who discover, mid audit, that the SOC 2 evidence the CISO thought was in place is the evidence the auditor cannot find.
Schedule a remediation sprint for the sixty days before the audit window opens. Not a thirty day scramble. A real, calendared, staffed sprint that closes the named gaps and produces the evidence the audit will require. Logs, tickets, screenshots, change records, the artifacts that cannot be reconstructed after the audit has run. The CISOs who treat the sprint as the scramble are the CISOs who quietly move the IPO filing date and pretend the move was on the underwriter.
Brief the CEO and the board on what the audit will and will not produce. The board is the audience the CISO cannot afford to surprise. The board sees the audit as the certification the CISO can deliver. The board does not see the audit as the report that names the gaps the CISO has been quietly deferring. The CISO who is honest about the report in the briefing is the CISO who has a board that defends the report when the underwriter quietly tests the report in diligence.
What to avoid
Do not rush a certification. A thirty day SOC 2 Type I is a signal to the underwriter that the CISO is hiding something, because a SOC 2 Type I in thirty days is the document the CISO is paying the auditor to produce without the evidence the auditor needs. The underwriter reads the report cover, sees the Type I, asks for the Type II, and quietly downgrades the company’s security posture in the diligence memo. The CISOs who have been quietly rushing the certification are the CISOs who find out, post IPO, that the dilution and the valuation multiple were the cost of the rush.
Do not skip the evidence collection. Logs, ticket trails, screenshots, change records, the artifacts that are expensive to reconstruct after the fact. A pen test report that lacks the test plan, the methodology, and the remediation evidence reads as the report the underwriter will quietly discount. A SOC 2 that lacks the sample tickets and the change records reads as the audit the auditor will qualify. The CISO who has been quietly forgetting the evidence pays the auditor to re run the audit and to invoice twice.
Do not overstate the maturity. The CISO who has been quietly writing the board deck to sound more mature than the programme is the CISO who will be tested in the diligence call by an engineer who actually ran the pen test. Mature programmes can defend the gap. Less mature ones cannot. The CISO who is honest about the gap in the board deck is the CISO who can talk about the gap in the diligence call without the call being the moment the underwriter walks away.
The bottom line
SOC 2 Type II on a real window, ISO 27001 if EMEA matters to the pipeline, pen test the underwriter cannot quietly discount. Readiness assessment at T minus ninety, remediation sprint at T minus sixty, board briefing before the underwriter is in the room. No rushed certifications, no missing evidence, no overstated maturity. The CISO who runs the three and avoids the three is the CISO who has survived the pre IPO audit and is still standing when the roadshow opens.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
