Pre-SOC2 / ISO 27001 security prep: what to do 30 days before (practical list)

If you’re 30 days out from SOC2 or ISO work, here’s a practical focus list:

• confirm asset inventory + owners (apps/APIs/repos/cloud accounts)
• access review: who has admin access and why
• logging: prove you can answer “who did what” for admin actions
• vulnerability management: how findings are tracked and fixed
• change management: show PR/review process + approvals
• incident response: at least a basic plan + a tabletop exercise

If you’ve been through audits: what was the most annoying “we should’ve done this earlier” item?