SOC 2 readiness

Reviewing current controls against the Trust Services Criteria and identifying gaps.

Deciding which systems, services and criteria the report should cover, starting with Security and adding Availability, Confidentiality, Processing Integrity or Privacy where customers need them.

Designing controls that meet the criteria and reflect how your organisation actually operates.

Putting controls into operation across people, process and technology, working with your team and suppliers.

Establishing how each control will be evidenced, and checking that evidence is complete and consistent.

Type 1 and Type 2 readiness. Preparing for a point-in-time examination, an examination over a period, or a Type 1 followed by Type 2. Remediation. Addressing gaps identified during readiness work before the examination period starts. Audit coordination. Supporting you in selecting a CPA firm and coordinating information requests during the examination. Ongoing control maintenance. Keeping controls and evidence operating between examinations, since Type 2 reports are usually renewed annually. Integration with ISO 27001. Where you also hold or are pursuing ISO 27001, mapping controls so that one set of evidence supports both.

No. SOC 2 is an examination performed by a licensed CPA firm, resulting in a report on your controls rather than a certificate. A consultancy cannot issue a SOC 2 report.

It depends on what your customers need and when. A Type 1 report can be produced sooner and demonstrates control design. Most customers eventually expect a Type 2 report, which requires controls to operate over an examination period.

Yes. The frameworks differ in structure and outcome, but many controls overlap. Designing controls and evidence once, then mapping them to both, avoids duplicated work.