SOC 2 compliance

SOC 2 readiness, from “where do we start” to a clean audit

A customer has asked for your SOC 2 report, or you started the process and stalled. We run the readiness programme and build the controls and evidence your auditor will want to see.

Book a 30-minute IT review Call 838-TENACIT

SOC 2 is the security report American companies ask their vendors for before they sign. If you sell software or services to businesses and you hold their data, you will be asked for one sooner or later.

Getting there is not mostly a technology problem. Most companies already do much of what SOC 2 asks. The work is in writing it down the way an auditor expects, filling the gaps, and collecting evidence that the controls actually run.

Where we fit. Compliance consultancies tend to hand you a report on what is wrong. Auditors are not allowed to fix it for you. We sit between the two: we build and run the controls, then support your audit.

We implement, operate and evidence the technical controls, and run the readiness programme up to the audit. Your CPA firm issues the report. Your counsel owns contracts.

What's included

Gap assessment: Where you stand against the SOC 2 Trust Services Criteria today, in plain language, with every gap listed.
Scoping: Which criteria you need beyond Security, which systems are in scope, and whether to start with a Type I or go straight to Type II.
Policies: The written policies an auditor expects, fitted to how your company actually works rather than copied from a template.
Technical controls: Multi-factor authentication, access reviews, logging, endpoint protection, backups, change management and vendor management, put in place and run.
Evidence collection: The screenshots, logs, tickets and records your auditor will ask for, gathered as you go instead of in a panic before fieldwork.
Working with your auditor: We answer the technical questions and supply the evidence, so your team is not translating between IT and the audit firm.
Remediation: If the audit finds exceptions, we fix them and document the fix.
Staying compliant: SOC 2 is annual. We keep the controls running and the evidence current through each observation period.

A good fit if

A customer or prospect has asked for your SOC 2 report and you have nothing to send.
You started SOC 2, hit the auditor's gap list, and stalled.
You are a software, services or research company handling customer data.
You are outside the US and need SOC 2 to sell to American customers.

Probably not the right fit if

You need the report itself issued. That has to come from an independent CPA firm, and it should.
You need penetration testing. We are a defensive security shop and will bring in a specialist for that.

How it works

Gap assessment

We review your systems, policies and practices against the criteria and give you the full list of what is missing.
A plan with a ceiling

What needs doing, in what order, and a not-to-exceed price for getting you ready.
Build the controls

Policies written, controls implemented, evidence collection running.
Audit

Your CPA firm performs the audit. We support fieldwork and answer the technical questions.
Stay ready

Controls and evidence kept current for next year's report.

How it's priced

Readiness work is quoted as a project, with a not-to-exceed price agreed before we start. Ongoing compliance support is scoped with you once you know what your auditor expects each year.

How our pricing works

Questions we get asked

Can you get us SOC 2 certified?

There is no such thing as SOC 2 certification, though the phrase is everywhere. SOC 2 is an attestation report issued by an independent CPA firm after an audit. We get you ready for that audit and keep you compliant afterwards. We do not issue the report, and nobody independent of the auditor should.

What is the difference between Type I and Type II?

A Type I report says your controls were designed properly at a single point in time. A Type II report says they actually operated over a period, usually several months to a year. Many customers will accept a Type I to start with and expect a Type II after that.

We started and got stuck. Can you pick it up part-way?

Yes, and it is common. Most companies stall at the same point: the auditor has listed the gaps in language that assumes you already know how to close them. We take that list and close the gaps.

We are not a US company. Can you help?

Yes. Companies outside the US often need SOC 2 to win American customers, and the security is usually not the problem. Knowing what a US auditor expects to see is. We work with clients outside the US now, and none of this work needs us in the room.

How does SOC 2 relate to HIPAA?

They overlap a lot. Many of the same controls serve both, so if you need both, we build them once and evidence them twice.