SOC 2 readiness, so the audit is the easy part.
We scope your report, design proportionate controls, collect the evidence and work with your auditor, so the customer deals waiting on a SOC 2 report keep moving.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
Usually, one of these is true.
We do not perform the SOC 2 audit or issue the report. That is done by an independent CPA firm.
- A customer, partner or health system has asked for your SOC 2 report before they sign.
- You answer the same security questionnaire repeatedly and want one report to replace it.
- You are a SaaS, fintech or health-tech company moving upmarket.
- You want security that scales with the company, not a one-off audit scramble.
SOC 2 at a glance
| Topic | What to know |
|---|---|
| The criteria | AICPA Trust Services Criteria. Security is always included. Availability, processing integrity, confidentiality and privacy are added when your customers need them. |
| Type I | Reports on the design of your controls at a point in time. |
| Type II | Reports on whether the controls operated effectively over an observation period. Most enterprise buyers ask for this. |
| Who issues the report | An independent CPA firm. It is never the firm that built your controls, which is why we do not audit our own work. |
From scoping to a clean report.
Scope and criteria
Decide which systems, services and criteria go in the report, based on what your customers actually require.
Readiness assessment
Test your current controls against the criteria and rank the gaps by effort and audit risk.
Design and remediate
Write the policies and put the controls in place, using the tools you already have wherever possible.
Evidence and observation
Set up evidence collection so the observation period runs smoothly and nothing is chased at the last minute.
Auditor liaison
Help you select the CPA firm, prepare your team for walkthroughs and sample testing, and close any exceptions.
Deliverables you can hand to an auditor.
Scoped on the free call and agreed as a fixed fee. Start with an Assess project, then Build and Manage as you need them.
- Readiness assessment against the Trust Services Criteria
- Scope, system description inputs and control matrix
- Policies, access reviews, vendor-risk and incident procedures
- Evidence calendar and collection plan
- Auditor selection support and walkthrough preparation
- Answers to customer security questionnaires from the same control set
Questions about SOC 2.
Type I or Type II first?
It depends on what your buyers will accept. Some will take a Type I to start, others insist on a Type II. We ask your largest prospects what they need before you commit.
Which criteria should we include?
Security is the baseline. Add availability, confidentiality, processing integrity or privacy only when a customer requires them, since each one adds scope and cost.
Can we do SOC 2 and ISO 27001 together?
Yes. The control sets overlap heavily, so one programme can support both, and we map evidence to each.
We use a compliance automation platform. Does that change things?
It helps with evidence collection. It does not decide your scope or write your risk judgement, which is where a senior lead pays off.
Related: ISO 27001 certification · Vulnerability management
Start with a free conversation about SOC 2.
A free 30-minute conversation to agree what matters most and what to do first. If you would like to prepare, answer the short questionnaire beforehand.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day