Compliance / SOC 2
Be ready when your biggest customer asks for a SOC 2 report.
For many B2B software and service companies, a SOC 2 report is now expected in enterprise deals. Procurement teams ask for it before they sign, and a missing report can stall a sale for months.
We help you prepare efficiently: choosing the right scope, putting controls in place that fit how your team already works and collecting evidence that stands up to the auditor.
At a glance
- Issued by
- A licensed CPA firm
- Based on
- AICPA Trust Services Criteria
- Always included
- Security (the Common Criteria)
- Optional
- Availability, Processing Integrity, Confidentiality and Privacy
- Report types
- Type 1 covers design on one date. Type 2 covers operation over a period, often 3 to 12 months.
SOC 2
Type 1 or Type 2?
A Type 1 report looks at whether your controls are designed properly on a single date. A Type 2 report tests whether they actually operated over a review period. Most enterprise customers want Type 2, but a Type 1 can be a useful first step while the Type 2 period runs.
Scope matters as much as type. Including every system and every optional criterion makes the audit longer and more expensive, and it does not always help the sale. We help you scope it to what your customers are actually asking for.
How we help
Readiness assessment
Know what the auditor will look for before they arrive.
- Scope and Trust Services Criteria selection
- Gap assessment against the criteria
- Control design that fits your stack and team size
- Review of vendors and subservice organizations
Control implementation
Controls that work with your existing tools and habits.
- Security policies people will actually read
- Access reviews, onboarding and offboarding
- Change management inside your Git and CI/CD workflow
- Logging, monitoring and incident response
- Vendor management
- Annual risk assessment
Evidence and audit support
A smoother audit with fewer surprises.
- Evidence collection plans
- Compliance automation platform setup and tuning
- Help choosing an audit firm
- Support during fieldwork
- Annual penetration test
Who issues the report
Only licensed CPA firms can issue a SOC 2 report. We do the readiness work and the security work behind it, and we coordinate with the audit firm you choose.
The path
A typical SOC 2 engagement
- 01
Scope
Choose systems and criteria based on what customers need.
- 02
Gap assessment
Compare current controls against the criteria.
- 03
Remediate
Implement missing controls and start collecting evidence.
- 04
Type 1
Optional point-in-time report to show early progress.
- 05
Type 2
Controls operate through the review period, then the auditor reports.
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
FAQ
Frequently asked questions
How long does it take to get a SOC 2 report?
It depends on where you start. Readiness work can take anywhere from a few weeks to several months. A Type 2 audit then needs a review period, commonly three to twelve months, before the auditor can issue the report.
Do we need a compliance automation platform?
Not necessarily. These platforms can save time on evidence collection, especially for small teams, but they do not implement controls for you. We can help you decide whether one is worth it and set it up properly if you choose one.
Is a penetration test required for SOC 2?
The Trust Services Criteria do not name penetration testing as a requirement, but most auditors expect some form of control testing, and many customers ask for a recent penetration test report alongside your SOC 2 report.
Find out where you stand on SOC 2.
A readiness review shows what an assessor would find today and what it will take to close the gaps.