SOC 2 Readiness
Structured SOC 2 readiness support - from gap analysis through to Type I and Type II audit. We help SaaS and technology companies build the controls and evidence that auditors actually require.
Trust Service Criteria coverage
We cover the full scope of Trust Service Criteria relevant to your audit - not just Security.
Security (CC)
The Common Criteria - the mandatory TSC for every SOC 2 report. Covers logical and physical access controls, system operations, change management, and risk mitigation. We map your current controls and close the gaps.
Availability (A)
System availability commitments - monitoring, incident management, and recovery capabilities. We help you define, document, and demonstrate your availability controls for customers with uptime requirements.
Confidentiality (C)
Controls over information designated as confidential - encryption, access restrictions, and data handling procedures. Essential for B2B SaaS handling customer data.
What we deliver
Readiness Assessment
A structured gap analysis against the Trust Service Criteria you're targeting. We identify what's in place, what's missing, and what needs to be evidenced - with a prioritised remediation backlog.
Controls Design & Implementation
We help design and implement the technical and operational controls required - from access reviews and vendor management to change control and encryption standards. Practical controls, not theoretical ones.
Evidence Collection & Management
SOC 2 Type II requires sustained evidence over an observation period. We help you establish the processes, tooling, and cadences to collect evidence continuously - so audit prep isn't a scramble.
Policy & Procedure Documentation
The full suite of policies your auditor will expect - information security, access control, incident response, change management, vendor risk, and more - written in plain language and tailored to your environment.
Type I Readiness Review
Before your Type I audit, we conduct a structured readiness review - checking control design, policy completeness, and evidence quality so your auditor doesn't find surprises.
Audit Support
We support you through the audit itself - preparing your team for auditor questions, reviewing evidence submissions, and responding to findings. Your auditor relationship, improved.
Type I or Type II?
SOC 2 Type I
A point-in-time assessment confirming that your controls are designed appropriately. Faster to achieve - typically 2–4 months from readiness. Often used to satisfy initial customer requests while building towards Type II.
Useful for demonstrating commitment quickly - but customers increasingly ask for Type II.
SOC 2 Type II
An assessment covering control effectiveness over a defined period (typically 6–12 months). The gold standard for enterprise customer requirements - demonstrates your controls work in practice, not just on paper.
The report that closes enterprise deals and unblocks procurement.
Ready to get SOC 2 ready?
Get in touch for a no-obligation conversation about your timeline, scope, and what the process looks like for your specific environment.