Services

Three engagements, one path to a clean report.

Take them in order or start wherever you are. Each one is quoted as a fixed fee after a scoping call, so you know the cost before work starts.

Stage 1–22–3 weeks

Readiness assessment

Before you sign with an auditor, find out what they will find. We define the system in scope, choose which Trust Services Criteria to include, and test your current environment against each applicable criterion.

You get a gap list your engineering team can work from directly: each gap mapped to a criterion, with an owner, an effort estimate and a fix.

Deliverables

Scope memo: system boundary, TSC selection, Type I vs. Type II recommendation
Control matrix mapped to the 2017 Trust Services Criteria
Gap register with owners, effort and priority
Remediation roadmap with a realistic audit date
Readout session with your leadership and engineering leads

Stage 31–4 months

Program build-out

Close the gaps with controls that fit how your team already works. The goal is a program that keeps running after the audit, without a full-time compliance hire.

If you use a compliance automation platform, we configure it properly and connect it to real evidence instead of checking boxes.

Typical scope

Information security policy set, written for your company
Identity and access: SSO, MFA, joiner/mover/leaver process, access reviews
Logging, monitoring and incident response runbooks
Change management and secure SDLC controls
Risk assessment and vendor risk management
HR controls: onboarding, training, background checks, offboarding

Stage 4–5Through the report

Audit support

A CPA firm performs the audit and issues the report. Your job is to answer their requests quickly and correctly. We run that process for you, from choosing a firm to reviewing the draft report.

For a Type II, we check in during the observation window so recurring controls, like access reviews, don't get missed.

Includes

Auditor shortlist and proposal review
System description (Section III) drafting
Evidence request tracking (the PBC list) and quality review
Walkthrough preparation and attendance
Exception responses and management assertion review

What I don't do

I don't issue SOC 2 reports. Only an independent licensed CPA firm can. Your auditor also has to stay independent of the controls it tests, which is why readiness help usually comes from someone other than the audit firm.

Beyond SOC 2

The same control set carries over to ISO 27001, HIPAA security safeguards and AI governance frameworks like ISO 42001. If those are on your roadmap, we can design for them now.

Not sure which engagement you need?

Most teams start with a readiness assessment. A scoping call will tell you if you can skip ahead.

Book a scoping call