For buyers
Fractional CISO (fCISO)
Learn more
Both
SOC 2 readiness
We get your controls and evidence ready for a SOC 2 examination, so the CPA firm finds a program that already runs.
Who it’s for
SaaS and technology service providers whose customers have started asking for a SOC 2 report, often in a security questionnaire or a procurement review. It also fits teams heading into a first Type 2 period, or cleaning up after a report with exceptions. Consulting firms can subcontract the same work. We do it remotely anywhere in the U.S.
We start with scope: which system the report will describe, which Trust Services Criteria categories belong in it beyond Security, and whether a Type 1 or a Type 2 report fits where you are. Then we walk the criteria against how your systems and people actually work, and tell you in plain language what a CPA firm would likely flag.
From there we help you close the gaps in the order that matters: the controls themselves, the policies behind them, and the evidence that shows they ran across the whole period. You go into the examination with a control set your engineers can operate and evidence the CPA firm can follow.
Nicholas has done SOC 2 audit analysis and remediation as an employee at several companies.
Deliverables
- A written scope: the system, the Trust Services Criteria categories in scope, and a Type 1 or Type 2 recommendation.
- A readiness assessment against the criteria in scope, with gaps in plain language.
- A remediation plan with an owner and a sequence for each open item.
- A control and evidence map your team can keep current through the examination period.
Timeline
It depends on your scope, how much is already in place, and when your customers need the report. The quote lays out the steps and dates.
Related
Next step
Start with a 30-minute call.
Tell us what you’re working on and when it’s due, and we’ll tell you the first two steps.
30-minute intro call on Google Meet