Scoping memo
The systems, data, and criteria in scope, the report type that fits your buyers, and a target audit window.
SOC 2 readiness assessment
A control-by-control review against the Trust Services Criteria, with a ranked plan to close every gap before your auditor arrives.
- 2 to 3 weekstypical duration
- Fixed feequoted after a scoping call
- Start hereour core engagement
Overview
What this covers
We assess your system against the AICPA Trust Services Criteria and tell you exactly what to fix before an auditor looks. Security is always in scope. Availability, Confidentiality, Processing Integrity, and Privacy can be added when a customer asks for them.
Deliverables
What you receive
Gap report
Every relevant control compared with what you do today, each finding rated by audit risk.
Remediation roadmap
Fixes ranked by effort and audit impact, with suggested owners and dates your engineers can work from.
Readout call
A 60-minute walkthrough of the findings, plus 30 days of follow-up questions by email.
Not included
- The audit itself or any SOC 2 report
- Penetration testing
- Hands-on cloud remediation
When your roadmap calls for this work, we tell you exactly what to ask for and refer you to a specialist.
How it works
About three weeks, start to finish
Before you sign
Intro and scoping call
Twenty minutes to understand your deal, your system, and your deadline. You get a fixed-fee proposal in writing.
Day 1
Kickoff
We confirm scope and criteria, then send a single evidence request list so your team knows exactly what to gather.
Week 1
Discovery
Short interviews with control owners and a review of your policies, platform results, and evidence. No production access needed.
Week 2
Gap assessment
Every relevant control is compared with what you do today and rated by audit risk.
Week 3
Roadmap and readout
You receive the gap report and a ranked remediation roadmap, and we walk your team through both.
30 days after
Follow-up
Questions come up as you fix things. Email them and get answers for a month at no extra cost.
Related services
Pair it with
2 to 4 weeks
Platform setup and policy tailoring
Get real value from Vanta or Drata: integrations connected, controls mapped, and policies rewritten to match how you work.
1 to 2 weeksRisk assessment and vendor risk
A documented risk register and vendor review process that hold up in an audit and keep working after it.
Know where you stand in three weeks.
Start with a 20-minute call. You will leave with a clear sense of your scope, the report type your buyers need, and a fixed-fee proposal.