Compliance / SOC 2
SOC 2 readinessWe get SaaS and service companies ready for SOC 2 Type I and Type II: scoping, gap assessment, policies, evidence and auditor coordination. If federal buyers are next, SOC 2 Type II is also your on-ramp to FedRAMP Class A.
SOC 2 is how service companies prove to customers that their data is handled securely.
Our SOC 2 self-assessment checks your controls against the Security criteria and shows where the gaps are.
Are your controls designed properly? Tested at a single point in time. A faster first report when a deal can’t wait.
Did your controls work over time? Tested across an observation period, often several months. What most enterprise buyers expect, and what FedRAMP Class A builds on.
Security is required in every SOC 2. Availability, Confidentiality, Processing Integrity and Privacy are added when your customers need them.
SOC 2 reports are issued by independent CPA firms. We prepare you and coordinate with your auditor.
Choose the systems, criteria and report type your customers actually need.
Gap assessment against the Trust Services Criteria you selected.
Close gaps in access, change management, vendor risk, monitoring and more.
Set up evidence collection that covers the full observation period.
Coordinate with your CPA firm and answer auditor requests quickly.
Audit fees are paid to your CPA firm and are separate.
What to have in place before your auditor arrives, criterion by criterion.
Download →If a deal needs a report quickly, Type I gets you one sooner. Most buyers eventually expect Type II, so plan for it either way.
An independent CPA firm. We get you ready and work alongside your auditor; we don’t issue the report ourselves.
Security is always included. Add others only when customers or contracts ask for them, since each one adds scope.
SOC 2 is an attestation report common in North America; ISO 27001 is a certification recognized worldwide. Many controls overlap, so one program can support both.
It depends on your gaps and, for Type II, the length of the observation period. A readiness assessment gives you a realistic timeline.
Book a 30-minute call. We’ll scope your report, flag your likely gaps and give you a realistic timeline.