Service · SOC 2 (security side)
SOC 2: we get the security controls audit-ready.
A SOC 2 has a security-engineering half and an audit/policy half. We do the security half - mapping and hardening the technical controls the Trust Services Criteria expect. The attestation itself is signed by an independent AICPA-registered CPA firm you retain; the audit, formal policy authoring, and legal work are theirs, not ours.
What we do
What technical security work does a SOC 2 need?
The controls an auditor tests on the security side - the part that is engineering, not paperwork.
Technical gap assessment
Where your security controls stand today against the security-relevant Trust Services Criteria. Output: a ranked backlog of what to fix.
Security control implementation
MFA, SSO, encryption in transit and at rest, centralized logging and monitoring, change management, and a secure SDLC. We help wire what does not exist yet.
Vulnerability management & VAPT
Penetration testing plus continuous scanning (Vexta) - the vulnerability-management evidence an auditor expects to see running.
Evidence-friendly setup
We configure controls so they naturally produce the logs and records your auditor will ask for. You and your auditor own the evidence program; we make the technical side clean.
Technical auditor support
When you retain your AICPA-registered CPA firm (your choice - we take no referral fee), we answer their security-control questions and help you show the technical evidence during fieldwork.
SOC 2 in plain English
A SOC 2 report is an independent CPA firm's opinion on your controls, measured against the AICPA's Trust Services Criteria. Security (the "common criteria") is always in scope. You add Availability, Processing Integrity, Confidentiality or Privacy only when your customers' commitments need them.
| Type I | Type II | |
|---|---|---|
| What it says | Your controls are suitably designed, at a point in time | Your controls are designed well and operated effectively over a period |
| Period | One date | A period you choose, often 3 to 12 months |
| When it fits | A first report to unblock a deal quickly | What most enterprise buyers ask for, and renewed every year |
A realistic timeline
- Readiness (typically weeks to a few months): scope the system, close the gaps, and start producing evidence.
- Type I (if you want one): fieldwork on a single date, then the report.
- Type II observation period: the controls run for the period you chose, for example 3, 6 or 12 months.
- Type II fieldwork and report: the auditor tests samples from across the period.
A hard customer deadline is the most common reason to start with Type I and move to Type II.
What drives the cost
- The CPA firm's fee, which depends on scope, the criteria included and the Type. It is paid to them, not to us.
- How far your controls are from audit-ready, which sets how much readiness work there is.
- Tooling, if you choose a compliance automation platform. It is optional, not a requirement.
- A penetration test, if your auditor or customers expect one.
Run your own numbers in the SOC 2 cost and timeline estimator.
What auditors usually ask to see
- Access reviews, plus onboarding and offboarding records
- MFA on the systems in scope
- Change management: tickets, reviews and approvals for production changes
- Vulnerability scans and evidence that findings were fixed
- Logging, monitoring and alerts that someone follows up
- An incident response plan and proof it was tested
- A risk assessment, vendor reviews, security training and background checks
- Backups and a tested recovery process
Does SOC 2 require a penetration test?
Not by name. The criteria ask you to evaluate and monitor your controls, and a recent penetration test is common evidence for that, which is why many auditors and customers expect one. If you are deciding between frameworks, read ISO 27001 vs SOC 2: which first?
How we scope it
How do we scope the SOC 2 security work?
We size this to your current maturity after a short scoping call - not a fixed program.
Assess
Technical gap analysis against the security-relevant criteria. You get a control backlog ranked by audit-impact and effort.
Implement
We harden the technical controls - access, encryption, logging/monitoring, vulnerability management, secure SDLC - and close the highest-impact gaps first.
Test
Penetration testing and scanning to confirm the controls actually hold, and to produce the evidence an auditor looks for.
Support fieldwork
We stand alongside you on the technical questions while your chosen CPA firm runs the audit and issues the report.
SOC 2 FAQ
Do you handle the audit itself?
What exactly do you do vs. not do?
What does it cost?
We already have ISO 27001 / good security. Does that help?
Further reading
Read more about SOC 2
Does SOC 2 Require a Penetration Test? What Auditors Expect
SOC 2 does not explicitly mandate a penetration test, but auditors universally expect one. It's critical for demonstrating control effectiveness for the Security Trust Services Criteria.
SOC 2 Type I vs. Type II: What Your First Enterprise Deal Actually Needs
As a SaaS founder or engineering lead, securing your first enterprise deal hinges on trust. Learn whether a SOC 2 Type I or Type II report is the right move for your initial client requirements.
Your SOC 2 Type II Readiness Checklist: A Startup's Guide
For SaaS teams of 10-30 people, SOC 2 Type II readiness means establishing and consistently operating core security controls for at least six months. This guide breaks down the essential steps to prepare for your first audit.
SOC 1 vs SOC 2: Picking the Right Report for Your SaaS Platform
When a customer's finance team asks for a SOC report, for most SaaS platforms, they need a SOC 2 report, not a SOC 1, to assess security and availability controls. Understanding the distinction is key to providing the correct assurance.
Why Enterprise Security Questionnaires Keep Blocking Your SaaS Deal
Enterprise security questionnaires often block SaaS deals not because of bad luck, but because they reveal an immature security program. The fix requires proactive strategy, a solid compliance foundation like SOC 2, and robust control implementation.
ISO 27001 vs SOC 2: Which Certification to Pursue First?
Deciding between ISO 27001 and SOC 2 for your SaaS company depends on your market focus and strategic goals. This guide provides a direct comparison to help you prioritize your compliance efforts.
Related: SOC 2 cost estimatorISO 27001 readinessvCISO services
Next steps
Pick the next step.
Pick whichever fits how far along you are - we will meet you there.
Run a free website scan
Point it at a website you own and get a findings summary - no sales call needed.
Get a quote
Four short fields below. A fixed quote back within one business day.
Book a call
30 minutes, no deck, no pre-qualification. Bring the actual problem.
Get a quote
Four fields. A fixed quote within one business day.
No sales call required to get a number. Tell us what triggered this and when you need it by, and we will come back with a fixed price for SOC 2 readiness.
SOC 2 on your roadmap?
Let's scope the security-controls work. The attestation stays with your CPA firm - we make sure the technical side passes.