SOC 2 readiness
SOC 2 readiness for Type I and Type II
Scope, control design, evidence collection and audit support, so you pass the SOC 2 audit your customer is waiting for.
months: the usual Type II observation window, during which your controls must operate effectively.
Trust Services Criteria: security is mandatory; availability, processing integrity, confidentiality and privacy are optional.
WHY IT COMES UP
WHY COMPANIES START SOC 2
SOC 2 rarely appears on a roadmap because someone wanted it. It appears because a US customer made the report a condition of the contract, usually with a deadline attached.
WHAT IS SOC 2, AND WHICH TYPE DO YOU NEED?
SOC 2 is not a certification and there is no certificate. It is an attestation report, written by an independent auditor, describing your controls and whether they meet the Trust Services Criteria. Your customer reads the report itself, not a badge.
A REPORT, NOT A CERTIFICATE
That distinction matters commercially. Because it is a report rather than a pass mark, its value depends on what it covers and how many exceptions it records, and both are shaped long before the audit starts.
TYPE I: DESIGN AT A POINT IN TIME
Type I describes whether your controls are suitably designed at a single point in time. It can be produced relatively quickly and is often enough to unblock a deal in progress.
TYPE II: OPERATION OVER A PERIOD
Type II describes whether those controls operated effectively over a period, typically between three and twelve months. It requires an observation window during which evidence accumulates, and it is what most enterprise customers actually want.
THE USUAL SEQUENCE
Most companies start with a Type I to unblock the immediate contract, then move to a Type II covering the following period. If your customer will accept a Type II directly and the deadline allows, going straight there saves an audit fee.
WHAT WE DO
Readiness and scope
Where you stand against the common criteria and the optional ones you actually need, with a clear split between genuine gaps and controls that exist but leave no evidence. We draw the system boundary around the service being attested and say no to criteria that add cost without unlocking a deal.
Control design and remediation
Building what is missing, in a form your team can operate without a consultant present.
Evidence and observation window
Setting up collection so the Type II window produces records as a by-product of working, rather than as a project at the end.
Audit support
Preparing your people, coordinating with the CPA firm, and handling questions during fieldwork.
A readiness assessment shows the gaps against the criteria your customer requires, and what can wait.
Which Trust Services Criteria apply?
Security is mandatory and forms the common criteria that every SOC 2 report covers. The other four are optional and chosen based on what you actually promise customers. Availability — if you commit to uptime. Processing integrity — if you process transactions where completeness and accuracy matter. Confidentiality — if you handle customer data under confidentiality obligations. Privacy — if you handle personal information and make commitments about it. Adding criteria you do not need is one of the most common and expensive mistakes. Every additional criterion expands the control set, the evidence and the audit fee, for every report that follows.
Who issues the SOC 2 report?
A licensed CPA firm. Independence is a requirement, so the same organization cannot both build your control environment and issue the attestation. We prepare you and support you through the audit; the opinion is theirs.
We already have ISO 27001. Does that help?
Significantly. An operating ISMS covers a large share of the SOC 2 common criteria, and the risk assessment, access control, change management and incident processes largely transfer. What differs is the evidence format and the auditor’s expectations: SOC 2 is tested by sampling across a period, so the emphasis moves from documented process to consistent records.
How long does SOC 2 readiness take?
Readiness work is measured in weeks; the Type II observation window is the fixed cost in calendar time and cannot be compressed. Plan backwards from your customer’s deadline. We size the readiness work after a scoping call and confirm it in writing before work starts.
We are a Canadian company selling to the US. Is SOC 2 realistic for us?
Yes, and it is increasingly the standard ask. Location is not an obstacle to the report; the auditor tests the controls of the defined system wherever the team sits. What does need deliberate attention is evidence of access management and data handling across a distributed team, because that is where questions concentrate.
Where do SOC 2 projects usually go wrong?
Three patterns repeat. The scope is drawn around the whole company instead of the service, which drags unrelated teams into the evidence. Evidence is reconstructed at the end of the Type II window, which the auditor sees and records as exceptions. And a compliance platform is treated as the program itself, although it does not make control decisions or run the risk assessment for you.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.