SOC 2 Readiness

Scoping, gap assessment, control design, and evidence preparation before your CPA firm begins the SOC 2 examination.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Walk into your SOC 2 examination prepared.

The challenge

A large cus­tomer asks for your SOC 2 re­port, and the deal now de­pends on it. Your team starts hunt­ing for ev­i­dence and finds con­trols that exist only in some­one's head. Gaps found dur­ing the ex­am­i­na­tion cost far more than gaps found be­fore it, and ex­cep­tions in the final re­port are hard to ex­plain to the cus­tomer who asked for it.

How we help

We start with scope. Which ser­vices, sys­tems, and lo­ca­tions be­long in the re­port? Which trust ser­vices cri­te­ria apply be­yond se­cu­ri­ty? Is a Type 1 re­port enough for now, or does your cus­tomer need a Type 2 re­port, which cov­ers how con­trols op­er­at­ed over a pe­ri­od of time?

Then we as­sess your gaps against the cri­te­ria, de­sign the miss­ing con­trols, and write the poli­cies and pro­ce­dures to sup­port them. We plan the ev­i­dence your au­di­tor will re­quest, build a readi­ness check­list, and run prac­tice walk­throughs so your team can ex­plain each con­trol with con­fi­dence.

We keep a clear line be­tween prepa­ra­tion and the re­port it­self. Only a li­censed CPA firm can per­form a SOC 2 ex­am­i­na­tion and issue the re­port. We don't. Our job is to make sure you're ready, and to co­or­di­nate with your CPA firm so work isn't du­pli­cat­ed.

What you get

  • SOC 2 scoping: Type 1 or Type 2, systems, and trust services criteria
  • Gap assessment against the AICPA Trust Services Criteria
  • Control design, plus the policies and procedures to support it
  • Evidence collection planning and a readiness checklist
  • Practice walkthroughs and interview preparation
  • Coordination with your CPA firm

Standards we work with: The AICPA 2017 Trust Services Criteria (with re­vised points of focus, 2022) and the SOC 2 de­scrip­tion cri­te­ria.

We aren't a CPA firm. We pre­pare you for a SOC 2 ex­am­i­na­tion. We don't per­form it or issue the re­port.

Good fit if a cus­tomer has asked for a SOC 2 re­port, or your first ex­am­i­na­tion is sched­uled and you aren't sure where you stand.

Questions clients ask

What's the difference between Type 1 and Type 2?

A Type 1 report describes your controls and whether they're suitably designed at a point in time. A Type 2 report also covers whether they operated effectively over a period, typically three to twelve months. Many customers expect Type 2.

Can you issue our SOC 2 report?

No. Only a licensed CPA firm can perform a SOC 2 examination and issue the report. We get you ready and work alongside your CPA firm.

More in Governance, Risk & Compliance

IT Risk Assessment

Identification and rating of the risks across your IT environment and critical business systems, measured against your risk appetite.

  • Risk identification across systems, processes, and IT operations
  • Likelihood and impact ratings tied to your risk appetite
  • A risk register with owners and treatment decisions
Learn more about IT Risk Assessment

Cybersecurity Risk Assessment

A threat-informed assessment of the cyber risks to your most important data and systems, rated in business terms.

  • Critical asset and data identification
  • Threat scenarios rated in business terms
  • A prioritized treatment plan for leadership
Explore about Cybersecurity Risk Assessment

Cloud Risk Assessment

An assessment of the risks in how you use the cloud, including provider dependence, data location, shared responsibility, and exit options.

  • Cloud service inventory and data classification
  • Provider, concentration, and exit risk
  • Shared responsibility gaps rated against your risk appetite
Learn more about Cloud Risk Assessment

GRC Program and Control Framework Design

One control library that links your risks, policies, controls, and obligations, so risk, compliance, and audit work from the same list.

  • An integrated risk and control library
  • A compliance obligations register linked to tested controls
  • Risk appetite statements and board reporting
Learn more about GRC Program and Control Framework Design

Information Security Policy Writing

Information security policies and standards, written or rewritten to fit how you operate and mapped to the frameworks your customers expect.

  • A policy and standard set sized to your organization
  • Mapping to NIST, ISO/IEC 27001, and SOC 2 criteria
  • An owner and review cycle for each document
Learn more about Information Security Policy Writing

Remediation Management

Issue and remediation tracking with owners, dates, and escalation, plus validation that each fix addresses the original risk.

  • Issue intake and prioritization
  • Owners, deadlines, and escalation paths
  • Closure validation before issues are closed
Learn more about Remediation Management

Third-Party Risk Management

A vendor risk program that tiers vendors by criticality and data access, so due diligence goes where the risk is.

  • Vendor tiering and due diligence
  • Third-party AI and fourth-party risk review
  • Event-driven reassessment and monitoring
Explore about Third-Party Risk Management

Vendor SOC Report Review

A close reading of your vendors' SOC reports: scope, exceptions, carved-out subservice organizations, and the user entity controls you must run.

  • Scope and coverage check against the services you use
  • Exception and carve-out analysis
  • Complementary user entity controls mapped to owners
Learn more about Vendor SOC Report Review

ISO/IEC 27001 Readiness

Scoping, gap assessment, and ISMS build-out to prepare you for an ISO/IEC 27001:2022 certification audit.

  • ISMS scope and Statement of Applicability
  • Risk assessment and treatment plan
  • Internal audit and management review planning
Explore about ISO/IEC 27001 Readiness

HIPAA and PCI DSS Readiness

Gap assessments and control design for the HIPAA Security Rule and PCI DSS v4.0, ahead of your assessor or regulator.

  • HIPAA Security Rule risk analysis support
  • PCI DSS v4.0 scoping and gap assessment
  • Control design and evidence preparation
Learn more about HIPAA and PCI DSS Readiness

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor