Attestation · SOC 2 Type 1 and Type 2
SOC 2
The AICPA attestation North American customers expect from service providers that store or process their data.
Overview
What is SOC 2?
SOC 2 is an independent attestation report, issued by a licensed CPA firm, on how well a service organisation’s controls meet the AICPA Trust Services Criteria. It is the standard request from US customers and increasingly from enterprise buyers everywhere.
Who needs it
- SaaS and technology companies selling into North America
- Service providers that host, process or have access to customer data
- Businesses fielding long security questionnaires in every enterprise deal
What’s involved
The path to SOC 2.
- 01
Choose your scope and criteria
Security is always included. We help you decide whether the other criteria add value for your customers.
- 02
Build the control library
A set of controls mapped to the Trust Services Criteria and to how your business actually runs.
- 03
Write policies and procedures
Covering risk, assets, access, people, suppliers, incidents and continuity.
- 04
Operate and evidence
Controls running consistently, with evidence collected automatically where possible.
- 05
Type 1 audit
The auditor confirms your controls are suitably designed.
- 06
Type 2 audit
The auditor tests that controls operated effectively across the observation period.
How we help
We carry the documentation. You bring the decisions.
One program, built around your business, mapped to every framework you need.
- Scope and Trust Services Criteria selection
- SOC 2 control library and policies
- Risk assessment and treatment plan
- Evidence readiness in Vanta
- Auditor selection and audit support
- Mapping to ISO 27001 if you need both
Ready to start on SOC 2?
Tell us where you are and where you need to be. We will spend 30 minutes understanding your situation and give you an honest view of the fastest sensible path.