SOC 2 Type II
The report North American customers ask for. We prepare controls and evidence and guide you with a CPA auditor through Type I and Type II.
AICPA Trust Services Criteria
- What is at stake
- Required to sell to North American customers
Who it applies to
- SaaS selling in the United States
- Cloud service providers
- Startups facing due diligence
Typical timeline
4 months (Type I)
AICPA Trust Services Criteria
In detail
The report US customers ask for.
SOC 2 is an AICPA (American Institute of CPAs) framework for evaluating the controls of a service organisation. It is not a certification: it is an audit report issued by an independent CPA firm.
It is based on the Trust Services Criteria: security (always required), availability, processing integrity, confidentiality and privacy. You choose which criteria to include based on what you promise customers.
A Type I report assesses control design at a point in time. A Type II tests that they operated over an observation period of 3 to 12 months, and it is what enterprise customers eventually ask for.
Real scenarios
Common situations.
First US customer
Procurement asks for SOC 2 before signing. A fast Type I unlocks the deal while Type II is completed.
I already have ISO 27001
We reuse up to 80% of the controls. We only close the gaps and prepare evidence in the auditor’s format.
Automating evidence
We connect GRC tooling to your cloud, Git and HR system so evidence collects itself during the observation period.
What you get
What you will have at the end.
- Readiness assessment
- Criteria and scope selection
- Policies and controls in place
- Evidence collection platform
- Coordination with the audit firm
- SOC 2 Type I and/or Type II report
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
SOC 2
What we focus on
- 01
Trust Services Criteria
- 02
Evidence automation
- 03
Vendor management
- 04
Type II observation period
SOC 2 Type II
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for SOC 2 Type II cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Can I do SOC 2 from Europe?
Yes. We work with CPA firms that audit European companies remotely.
What is SOC 3?
A summarised public version of SOC 2 meant for your website. The full SOC 2 is shared under NDA.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.