SOC 2
Define the scope, organise the evidence and plan your SOC 2 engagement around your systems and customer requirements.
What we can help with
- Engagement and system-scope discussion
- Readiness assessment
- Controls and evidence preparation support
- Examination planning and coordination
- Ongoing evidence and renewal requirements
How we work
Scope
Understand your system, customer expectations and the engagement required.
Prepare
Review controls, evidence and gaps against the agreed scope.
Examine
An independent licensed CPA firm performs the examination and issues the report.
Readiness and the independent examination are distinct
Start with the system and customer requirement you need to address. We discuss the appropriate scope, readiness work, controls and evidence before agreeing an engagement. The team responsible for readiness and the independent CPA firm responsible for examination have different roles; those responsibilities must be explicit.
A SOC 2 report is not a blanket guarantee about every aspect of your security. The system boundaries, relevant criteria and examination period matter. Type I and Type II requirements, evidence availability and the work needed to address gaps influence the plan and quote. This is a separately scoped service, not ISO 27001 certification or general security consulting.
Common questions
Who issues the SOC 2 report?
The independent licensed CPA firm responsible for the examination issues the report. Readiness and examination responsibilities are defined in your engagement.
Do we need Type I or Type II?
We discuss the customer requirement and your readiness before scoping the engagement and timing.
Ready to discuss soc 2?
Tell us about the company, the records you have and the work you need. We will clarify the scope and next steps.