SOC 2 Readiness
The SOC 2 report your customers ask for, without stalling your roadmap.
Compliance Gauge scopes, implements and evidences your SOC 2 controls, then works directly with the CPA firm through Type I and Type II.
What it is
SOC 2 is an attestation report issued by a licensed CPA firm on the controls you use to protect customer data, organized around the AICPA Trust Services Criteria. Type I looks at control design at a point in time; Type II tests that the controls operated over a period, usually six to twelve months. Enterprise buyers increasingly treat a Type II report as the price of admission.
Who needs it
- SaaS and software companies selling to mid-market and enterprise
- Managed service providers and data processors
- Fintech, healthtech and any vendor receiving security questionnaires
- Companies preparing for due diligence or an acquisition
What we do
- Criteria and system-boundary scoping (Security, plus Availability, Confidentiality, Processing Integrity, Privacy as needed)
- Control design and a policy set written for how you actually operate
- Technical implementation: MFA, logging, endpoint, backup, vendor management
- Continuous evidence collection through the observation window
- Auditor selection, coordination and response to findings
- Annual renewal support so year two is easier than year one
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
What is the difference between SOC 2 Type I and Type II?
Type I reports on whether your controls are suitably designed at a point in time. Type II reports on whether they operated effectively over a period, typically six to twelve months. Enterprise customers generally expect a Type II.
How long does a SOC 2 take?
Readiness usually takes six to twelve weeks. A Type I can follow immediately. A Type II requires an observation window of at least three months, more commonly six to twelve, before the auditor issues the report.
Do you issue the SOC 2 report?
No. Only a licensed CPA firm can issue a SOC 2 report. We prepare you, collect the evidence and work with the audit firm; you choose the firm, and we can recommend ones we have worked with.
Which Trust Services Criteria do we need?
Security is required. Availability, Confidentiality, Processing Integrity and Privacy are added based on what your customers ask for and what your service does. Most SaaS companies start with Security plus Availability and Confidentiality.
Can SOC 2 controls be reused for other frameworks?
Yes. We map controls once, so adding HIPAA or ISO 27001 later reuses most of the same policies and evidence.
Find out where you stand on SOC 2.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.