SOC 2 readiness consulting
A customer asks for SOC 2, and the application is not ready for it. SOC 2 is an attestation report under the AICPA Trust Services Criteria, not a certification. We scope the examination, close the gaps in the application, collect the evidence, and coordinate the review. A licensed CPA firm examines the controls and issues the report. We do not issue it, and we do not build the compliance software.
For example: Type 1, Type 2, Security, Availability
Typical engagement
How it starts
A written scope
The report
Issued by a CPA firm
What's included
6 capabilities
- Scoping for the systems and Trust Services Criteria the customer actually named
- Gap assessment against the controls that apply
- Remediation in the application: access, logging, change management, backups, and encryption
- Policies written for how your company actually operates
- Evidence collection and an index the examiner can use
- Coordination of the compliance platform and the examination
Every project ships with Gap report, Evidence index, A clear handover.
Type 1 and Type 2, in plain language
Type 1 answers: are the controls designed properly, as of a date? Type 2 answers: did those controls actually operate over a period? Customers often say "SOC 2" and mean one of the two. The proposal names which one, because the calendar is different.
We will not tell you a Type 2 can be finished in a few weeks. The observation period is real time. What we can start immediately is the gap assessment and the remediation that has to be in place before that period is useful.
What we do, and what the CPA firm does
We scope the system, find the gaps, and close them in the application: who can get in, what is logged, how changes ship, how backups are tested, and how data is encrypted. Policies are written for the way your company works, not copied from a template that describes a different business.
The licensed CPA firm examines the controls and issues the report. We collect the evidence, keep an index, and stay on as the liaison so your team is not translating between the auditor and the application.
Questions
Common questions
- Is SOC 2 a certification?
- No. SOC 2 is an attestation report. A licensed CPA firm examines the controls and issues the report. We prepare the application and coordinate the examination. We do not issue the report.
- What is the difference between SOC 2 Type 1 and Type 2?
- A Type 1 report describes how the controls are designed at a point in time. A Type 2 report describes whether those controls operated over a period, commonly three to twelve months. The observation window is calendar time agreed with the auditor. We will tell you which one the customer is actually asking for.
- What are the Trust Services Criteria?
- Security is the common criteria: access, operations, and change management. Availability covers uptime commitments. Processing Integrity covers whether processing is complete and accurate. Confidentiality covers information you have agreed to protect. Privacy covers personal information. Most first examinations are Security only, unless a customer named more.
- How long does SOC 2 readiness take?
- The remediation work is scoped in writing before it starts. A Type 2 report also includes an observation window, commonly three to twelve months, which is calendar time agreed with the auditor. We do not compress that window.
- What do we get at the end?
- A gap report, an evidence index the examiner can use, policies written for how you operate, and a handover. The CPA firm issues the report itself.
- Do you build the compliance software?
- No. A compliance platform collects the evidence, and a licensed CPA firm performs the examination. We arrange both and stay on through the review.
Other services
Looking for something else? Each of these can stand alone, or combine with the work on this page.
- HIPAA readinessWe prepare the systems a small healthcare company needs ready for a HIPAA review: access, logging, backups, and the evidence to show it.
- PCI DSS readinessWe narrow where card data lives, close the gaps, and prepare the evidence. A qualified assessor issues any formal report.
- ISO 27001 readinessWe prepare the security management system and the evidence. An accredited certification body issues the certificate, not us.
- Compliance readinessSOC 2, HIPAA, PCI DSS, and other frameworks. We prepare your application and coordinate the examination.
A customer asking for SOC 2?
Tell us which report they named, and we will outline what the project covers.