A customer asked for your SOC 2 report
Enterprise buyers increasingly require a SOC 2 Type II report before they sign or renew. Without one, the deal tends to wait in procurement until you can produce it.
- Home
- Frameworks
- SOC 2
SOC 2, built to pass the audit and the customer review behind it.
A SOC 2 report is issued by an independent CPA firm. I get you ready for that examination: the right scope, controls that actually run, and evidence that holds up.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — When it comes up
Why companies call me about SOC 2
SOC 2 usually arrives as a condition of a deal, not a strategic plan. These are the three ways it typically shows up.
You need to choose between Type I and Type II
A Type I report covers whether your controls are designed properly at a point in time. A Type II report covers whether they operated effectively over an observation period, commonly three to twelve months. Most buyers want Type II; a Type I can bridge the gap while you build the history.
You bought a compliance platform and stalled
Automation tools collect evidence well. They don’t decide your scope, write policies that match how your team works, or fix the controls that fail. That is the part I do, with or without a platform.
02 — How the work runs
How I build it
The same sequence every time, sized to your company. Nothing goes in that you won’t actually run.
01
Scope and criteria
Decide which services and systems are in the report, and which Trust Services Criteria apply. Security is always included; Availability, Confidentiality, Processing Integrity, and Privacy are added only when your customer commitments call for them.
02
Gap assessment
Measure where you stand against the criteria and rank the gaps by audit impact, so the first fixes are the ones an auditor would test first.
03
Controls and policies
Access reviews, change management, vendor management, risk assessment, and incident response, written for how your team actually works rather than copied from a template.
04
Operate and collect evidence
Controls have to run before they can be tested. For Type II, the observation period starts once they are operating, so this step sets the earliest realistic report date.
05
Auditor selection and audit support
Help choosing a CPA firm that fits your size and timeline, preparation for fieldwork, and support through auditor requests and any exceptions.
03 — Fixed fees
What it costs
Fixed fees, agreed in writing before work starts. No open-ended hourly arrangements.
Deal-Unblock Sprint
$3,500 fixed
One stalled security questionnaire answered in 10 business days.
- The completed questionnaire
- A reusable evidence pack for the next one
- A gap list with fixes ranked
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Gap report against the SOC 2 Trust Services Criteria you need
- Risk summary
- 90-day roadmap to audit readiness
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentProgram Implementation
From $30,000 fixed
ISO 27001 or SOC 2 built and audit-ready.
- Scope and gap assessment
- Risk assessment and treatment
- Policies, procedures, and controls written for how you operate
- Internal audit and management review
- Support through the certification or attestation audit
04 — Questions
Common questions
Straight answers to what clients usually ask first. Anything else, bring it to the call.
Can you issue our SOC 2 report?
No. Only a licensed CPA firm can perform the examination and issue the report. I prepare you and support you through it. Keeping those two roles separate is part of what makes the report credible to your customers.
How long does SOC 2 take?
It depends on your starting point. Readiness work often takes a few months, and a Type II report then needs an observation period, commonly three to twelve months. The Readiness Assessment gives you a realistic date for your situation.
Do we need a compliance automation platform?
Not necessarily. Platforms help with evidence collection, especially as you grow. I work with the one you have, or without one if your environment is small enough not to need it.
We already have ISO 27001. How much carries over?
A large share of the control work maps across, including risk assessment, access control, supplier management, and incident response. The gap is usually narrower than starting from nothing.
Next step
Book a discovery call
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com