SOC 2
Compliance
Prepare for your SOC 2 audit with a clear plan. We help you put controls in place and gather the evidence your auditor needs.
Overview
The report enterprise buyers ask for.
We run a readiness assessment, design and implement the controls, set up evidence collection, and coordinate with your CPA/auditor through Type I and into Type II — focusing on controls that fit your operations, not bureaucracy.
Scope
What we deliver.
Readiness through report, across the Trust Service Criteria.
- Readiness & gap assessment
- Trust Service Criteria scoping
- Control design & implementation
- Policies & procedures
- Evidence collection & automation
- Vendor & access management
- Type I & Type II preparation
- Auditor (CPA) coordination
FAQ
SOC 2 FAQ
Scope, cost, and what happens next.
How much does SOC 2 cost?
Our SOC 2 readiness support is typically €2,500–4,000 per month over 3–6 months, separate from the auditor’s fees. Use our estimator for a tailored figure.
What is the difference between SOC 2 Type I and Type II?
Type I assesses whether controls are designed appropriately at a point in time. Type II assesses whether they operated effectively over a period (usually 3–12 months). Most enterprise buyers want Type II.
How long does SOC 2 take?
Readiness typically takes 3–6 months. A Type II observation window then runs for a further 3–12 months before the report is issued.
Is SOC 2 the same as ISO 27001?
No, but they overlap heavily. ISO 27001 is an international certification; SOC 2 is a US-style attestation. We can pursue both together efficiently.
Do you perform the SOC 2 audit?
No — the audit must be performed by a licensed CPA firm. We prepare you fully and coordinate with the auditor.
Which Trust Service Criteria do we need?
Security is mandatory; Availability, Confidentiality, Processing Integrity, and Privacy are added based on your customers’ requirements. We help you decide.
More questions about this service
Should we start with Type I or Type II?
Many start with Type I to show design quickly, then move to Type II for operating effectiveness, which is what most enterprises ultimately require.
How long is the Type II observation window?
Usually 3–12 months; we help you choose a window that balances speed with auditor and customer expectations.
Can you recommend a CPA/auditor?
Yes — we work with several audit firms and coordinate the engagement, keeping the auditor independent.
Can we reuse SOC 2 work for ISO 27001?
Yes — the control sets overlap heavily, so we run them together to avoid duplicate effort.
Related services
Explore more.
Ready to start SOC 2?
A 30-minute scoping call costs nothing. A stalled enterprise deal costs considerably more.
Book a short call Send an email