Practice area
SOC 2 readiness
A SOC 2 report is not paperwork you produce at the end. It is a description of how your business actually operates, verified over a period of time. Readiness is the work of making that description true — then proving it with records that already exist.
First, an important distinction
Readiness is our work. The report is not.
A SOC 2 report can only be issued by an independent CPA firm. No managed service provider can certify you, and any provider implying otherwise is worth walking away from.
What we do is prepare you: assess the gap between your current operations and the trust services criteria, implement the controls and the record-keeping that close it, run the evidence collection so it happens continuously instead of in a panic, and coordinate with the auditor you engage. You choose the auditor; we make sure they are not discovering problems you could have fixed six months earlier.
Type I and Type II are different questions Type I asks whether your controls are suitably designed at a point in time. Type II asks whether they operated effectively across a period. Type II is usually what customers and enterprise procurement actually want, and the clock only starts once the controls are genuinely running.
Where readiness usually fails
Not at the auditor. Long before it.
The same handful of problems explains most stalled or expensive readiness efforts. All of them are cheaper to fix before the audit window opens.
Policies nobody follows
A downloaded policy template that describes an organization you do not run is worse than no policy. The auditor tests practice against the document, and the gap is the finding.
Controls that exist but leave no trace
Access reviews that happen verbally, changes made without a record, alerts reviewed and forgotten. If it is not recorded, it did not happen as far as the audit is concerned.
Scoping that is either too wide or too narrow
Scope too wide and you are auditing systems that do not matter. Too narrow and the report does not cover what your customers actually need assurance about.
Evidence gathered after the fact
Reconstructing a year of screenshots the month before the audit is expensive, error-prone, and often impossible. Evidence has to accumulate as a side effect of the work.
Nobody owning it internally
Readiness is a project with decisions, deadlines, and owners. Without an internal owner, the work drifts and the audit window slips a quarter at a time.
Infrastructure that resists change
Shared admin accounts, unmanaged endpoints, and undocumented networks make the access and change criteria genuinely hard to satisfy — usually the deepest and most expensive gap.
How an engagement runs
Four phases, one calendar
-
1
Scope
We agree what is in scope — the systems, the data, the trust services criteria — and who inside your business owns each piece. Scope decisions drive everything downstream, so they are made deliberately and in writing.
-
2
Gap assessment
We compare how you operate today against the criteria and produce a prioritized list: what is already satisfied, what needs a control, and what needs a working practice behind it. This is the document that tells you what the effort will actually cost.
-
3
Build
Policies written around your real process, controls implemented in the environment, and evidence collection wired into the tools and routines your team already uses. This is where managed IT and security systems pay for themselves twice — the infrastructure work and the compliance work are the same work.
-
4
Operate and audit
Controls run, evidence accumulates, and we hold a review cadence so drift gets caught early. When the audit window opens, your team walks the auditor through controls that are already working, with records already organized.
The honest sequencing note If your environment is still being brought under management, do readiness in that order: get infrastructure documented, monitored, and access-controlled first. Attempting to satisfy Type II over a period when the underlying environment is still being rebuilt usually means repeating the audit window.
Questions
SOC 2, answered
Do you issue the SOC 2 report?
No, and nobody who advises you on controls should. The report is issued by an independent CPA firm you engage. We do readiness: scoping, gap assessment, policy and control implementation, evidence collection, and coordination with that firm. We are happy to work with an auditor you already use, or to help you evaluate a few if you have not chosen one.
Type I or Type II — which do we need?
It depends on who is asking. Enterprise customers and security questionnaires generally want Type II, because it covers sustained operation of controls rather than design at a moment in time. Some organizations start with Type I as a checkpoint. We will look at what your customers and prospects are actually requesting and recommend accordingly, rather than defaulting to the more expensive option.
How long does readiness take?
It scales with the size of the environment and how much of it is already under management and documented. The gap assessment is the point at which we can give you a real timeline instead of a range — and by then the controls in scope, the work required, and the sequence are all known.
Do you write our policies?
We draft them, and then we rewrite them around how your business actually operates. A policy you did not participate in producing is one your team will not follow, and an auditor will notice within the first walkthrough. Expect drafts to come back with your input, not to arrive finished.
What if we are not a managed IT client?
Readiness work can be done on an environment someone else manages, but it is slower and the findings are harder to remediate, because we are advising on systems we do not operate. Where the environment is under our management, the control work and the operations work happen in the same place, which is usually both faster and less expensive overall.
Are you SOC 2 certified yourselves?
We are not, and we will not claim to be. Our own controls and documentation practices are built the same way we build them for clients, and we will answer any question your assessor asks about how we handle your data. If a report from us is required for your own procurement, tell us and we will say plainly where we stand.
Find out what the gap actually is
A scoping conversation and a gap assessment turn an open-ended compliance project into a costed, sequenced plan.