A readiness review against the SOC 2 Trust Services Criteria, identifying where your controls and evidence will not survive an auditor's testing before the observation window opens.
SOC 2 is not one fixed checklist. The criteria that apply depend on which Trust Services categories you commit to.
We map your existing controls to the criteria in your scope, so effort goes to what your report will actually cover rather than to everything the standard could include.
A Type II fails on operation far more often than on design, and the two gaps have very different timelines.
We separate controls that are missing from controls that exist but produce no reliable evidence, because the second category takes an observation period to fix and cannot be closed the week before an audit.
Most readiness gaps are evidentiary rather than technical: the control works, but nothing proves it worked consistently.
We test whether your evidence would survive auditor sampling, covering ticket trails, approval records, access reviews and change management, and identify where automation would make evidence collection sustainable.
It reviews your controls and evidence against the Trust Services Criteria in your scope before a formal audit, identifying what would fail an auditor's testing while there is still time to fix it. It is not an audit and produces no opinion, which is precisely why it can be more direct about what is not working.
Well before your observation window opens. A Type II examines whether controls operated effectively over a period, so a control implemented the month before the window closes has almost no evidence behind it. Three to six months of lead time is typical for a first Type II.
It supports several criteria, particularly around change management and monitoring, and in practice enterprise customers ask for it during security review whether or not your auditor requires it. It is one input to a SOC 2 program rather than a substitute for one.
No. A SOC 2 examination must be performed by an independent CPA firm, and we are not one. That separation is useful: we can be considerably more direct in a readiness review than an auditor can be, because we are not issuing an opinion.
Scope this with a senior operator. Fixed scope, fixed price, no obligation.
No obligation, no sales pressure. A senior operator replies within one business day.
