SOC 2 readiness support
Get ready for your SOC 2 audit without the guesswork.
Scoping, gap assessment, controls and evidence preparation, so your auditor finds a programme that already works.
Why teams call us
Problems this solves
-
01
A US customer asked for a SOC 2 report
Enterprise buyers, especially in the United States, increasingly require a SOC 2 report before signing.
-
02
Not sure where to start
Scope, criteria, Type 1 or Type 2, tools and auditors are all new decisions.
-
03
Controls exist only in people's heads
Access reviews, change approvals and incident handling happen, but nothing is documented or evidenced.
-
04
A small team with no compliance function
Engineers end up writing policies instead of building the product.
Our approach
SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards. It assesses your controls against the Trust Services Criteria: security (always included), and optionally availability, processing integrity, confidentiality and privacy. A Type 1 report looks at control design at a point in time; a Type 2 report tests how controls operated over a period, commonly three to twelve months.
We do not issue SOC 2 reports and never describe our work as certification. We get you ready: we define the scope, assess gaps against the criteria, write the policies, help implement the controls and set up the evidence your auditor will ask for, then support you during the audit.
What is included
-
Scoping
Systems, people, vendors and criteria in scope, and Type 1 versus Type 2.
-
Gap assessment
Current controls compared with the Trust Services Criteria.
-
Policies and procedures
A policy set sized for your company, not a generic template pack.
-
Control implementation
Access reviews, change management, logging, vendor reviews, backups and incident response.
-
Evidence preparation
What to collect, where it lives and who owns it.
-
Audit support
Help responding to auditor requests during fieldwork.
What you receive
- Scope and system description draft
- Gap assessment report
- Remediation roadmap
- Policy and procedure set
- Control and evidence matrix
- Readiness review before the audit
Technology we work with
- AICPA Trust Services Criteria
- SOC 2 Type 1
- SOC 2 Type 2
- Vanta
- Drata
- Jira
- Google Workspace
- Microsoft 365
Industries
How an engagement runs
Every engagement starts with a signed agreement and an advance payment as set out in your proposal. Work begins once both are complete.
-
01
Scope
Criteria, systems and audit type chosen with you.
-
02
Assess gaps
Interviews and evidence review against the criteria.
-
03
Remediate
Policies, controls and evidence put in place.
-
04
Audit-ready
A readiness review, then support through the audit with your chosen CPA firm.
Ready to start? Talk to us directly.
Tell us what you need in a few lines. A specialist replies with next steps and a written proposal before any work begins.
Frequently asked questions
Can't find your answer? Ask us
Do you issue the SOC 2 report?
How long does SOC 2 readiness take?
Do we need a compliance automation tool?
Is SOC 2 relevant for Indian companies?
Is SOC 2 the same as ISO 27001?
Start with a conversation.
Share a few details. A specialist replies with next steps, usually starting with a short call.