Information security
SOC 2
SOC 2 Trust Services Criteria
A US attestation report on security, availability, processing integrity, confidentiality and privacy controls.
Typical timeline
Type I in about 3 months; Type II adds a 3 to 6 month observation window.
What you end up with
A report your customer's procurement team accepts, without rebuilding controls from scratch.
Who it applies to
Is this your situation?
SaaS and service providers selling into US customers who ask for a SOC 2 report rather than a certificate.
01SaaS and managed-service providers selling into the US
02Data processors handling customer records
03Companies already holding ISO 27001 and asked for SOC 2
How we help
What we actually deliver
Readiness assessment, control mapping against existing ISO work, evidence collection design, auditor coordination.
▪Readiness assessment against the Trust Services Criteria
▪Control mapping onto existing ISO work
▪Evidence collection design for the observation window
▪CPA firm coordination through the examination
Often held together