SOC 2
AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. Type I reports on design at a point in time; Type II on operating effectiveness over a period, typically three to twelve months.
Readiness items we start from
- Security policies approved and reviewed in the last year
- Access control with MFA and quarterly access reviews
- Change management with approvals and logs
- Vendor and sub-processor inventory with risk reviews
- Incident response plan, tested
- Business continuity and backups, tested
- Monitoring and logging retained
- Risk assessment performed and documented
The framework's own criteria or clauses govern; this list is where most companies have gaps.
Timeline and cost, honestly
Readiness two to four months for a company with basic controls in place. A SOC 2 Type I can follow readiness directly; Type II needs an observation period, typically three to twelve months. Auditor and certification-body fees vary by scope and are paid to them; ask for quotes from more than one. Our readiness fee covers preparation, the readiness review and the auditor introduction.
Start with SOC 2
Tell us the buyer who is asking and what you already have.