SOC 2 readiness: what your customer is actually asking for
Customers say "SOC 2" and mean different reports. This is how to read the request before you spend a year on the wrong one.
It is a report, not a badge
SOC 2 is an attestation report under the AICPA Trust Services Criteria. A licensed CPA firm examines the controls and issues the report. It is not a certification you can buy, and the firm that prepares your application is not the firm that issues the report.
When a customer says they need SOC 2, ask which report. A Type 1 report describes how controls are designed at a point in time. A Type 2 report describes whether those controls operated over a period, commonly three to twelve months. The observation window is calendar time agreed with the auditor. It cannot be rushed.
What they are usually checking
Most first requests are about Security: who can access the system, how changes are made, whether you can see what happened, and whether backups exist. Availability, processing integrity, confidentiality, and privacy are separate criteria. Do not assume they are in scope because the email said "SOC 2."
The readiness work is the unglamorous part: close the gaps in the application, write policies that match how you operate, and collect evidence an examiner can follow. Mizuno does that preparation and stays on as the liaison. The CPA firm issues the report.
What to do with the email
Reply with two questions: Type 1 or Type 2, and which criteria. Then look at the system they are actually buying. A scope wider than that system wastes the observation period.
If you want a written view of what the project would cover, start with a free 30-minute assessment. We will say if the request is outside what we should take on.
If this is the project
Read SOC 2 readiness consulting, or start with a free 30-minute assessment.