Frequently asked questions

Most assessments take 2 to 3 weeks from kickoff to readout. The biggest factor is how quickly your team can share policies and evidence. We send the evidence request list on day one so nothing waits on us.

Expect to spend 4 to 6 hours of your own time across the engagement, mostly in a kickoff call, a few short interviews with control owners, and the readout.

That depends on your gaps and the report type. After the assessment, most teams spend one to three months fixing what we find. A Type 1 audit can follow soon after. A Type 2 audit needs an observation period, often three to twelve months, before the auditor can report. Your roadmap includes a realistic timeline for your situation.

No. We work from screenshots, read-only exports, and conversations with your team. We never ask for passwords, admin accounts, or production credentials.

A SOC 2 audit is performed by a licensed CPA firm, which issues the report your customers ask for. A readiness assessment happens before that. It shows you where your controls fall short so you can fix them before the auditor looks.

Hartgate Advisory does readiness work only. We are not a CPA firm and do not issue reports or opinions. Keeping the two separate also protects your auditor's independence.

A Type 1 report looks at whether your controls are designed properly at a single point in time. A Type 2 report tests whether those controls actually operated over a period of time, usually three to twelve months.

Many enterprise buyers ultimately want Type 2. Some startups get a Type 1 first to unblock a deal sooner, then move to Type 2. We help you decide which makes sense for the customers you are selling to.

Security is required in every SOC 2 report. Availability, Confidentiality, Processing Integrity, and Privacy are optional. Most early-stage companies start with Security alone, or Security plus Availability or Confidentiality if a customer asks for it. Adding criteria you do not need increases cost and effort without helping the deal.

No. Many teams come to us before choosing a platform, and the assessment helps them decide whether they need one. If you already have Vanta or Drata, we use its test results as a starting point instead of repeating work.

We are platform-neutral and not affiliated with either company, so our advice is based on your situation.

Platforms automate evidence collection and flag failing tests. Someone still has to decide scope, rewrite template policies to match how you really work, assign owners, judge which failures matter to an auditor, and answer the auditor's questions. That is the work we do. See what that looks like for Vanta and Drata customers.

Every engagement is a fixed fee, agreed in writing before work starts. The price depends on your scope, the criteria you include, and the add-ons you choose. We quote after a short scoping call. Founding clients receive introductory pricing in exchange for a short testimonial.

No, and you should be wary of anyone who does. Only your auditor decides what goes in the report. We make sure you know your gaps and have a clear plan to close them, which is what gives you the best chance of a clean result.

Caleb Akinfolarin, directly. Hartgate Advisory takes on no more than two engagements at a time, so you are not handed off to a junior team.

No. We do not perform penetration tests, hands-on cloud remediation, or incident investigations. When your roadmap calls for that work, we tell you exactly what to ask for and refer you to a specialist.