SOC 2 readiness assessment
A SOC 2 report is issued by a CPA firm. Our work comes before that: we agree which Trust Services Criteria apply, check that a working control exists for each, and test evidence the way an auditor will, so your observation period starts with controls that hold up.
Who it is for
- SaaS and service providers whose customers have started asking for a SOC 2 report.
- Teams deciding between a Type I and a Type II report, and when to start the observation period.
- Companies whose last report came back with exceptions they want closed before the next one.
What we assess
- Security (the common criteria), which every SOC 2 report includes.
- Availability, Confidentiality, Processing Integrity and Privacy, where your customers or contracts need them.
- Your system description and boundary, and how subservice organizations such as your cloud provider are treated.
- Physical access under CC6.4, tested on site rather than taken from a policy. See SOC 2 CC6.4.
What you receive
- A readiness register: criterion, control, evidence sampled and any gap.
- Control design fixes written so the operator can act on them.
- A recommended report type and observation period start date.
- A remediation plan with a price range on every item.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four weeks for the Security criteria plus up to two additional criteria.
Common questions
Type I or Type II?
A Type I report covers the design of your controls at a point in time. A Type II report also covers whether they operated effectively over a period, commonly between three and twelve months. Most customers ask for Type II; a Type I can be a useful first report while the observation period runs.
Do you issue the SOC 2 report?
No. Only a licensed CPA firm can issue a SOC 2 report, and we are not a CPA firm. We prepare you for the audit, and we have no referral arrangement with any audit firm.
Which criteria should we include?
Security is always included. Add the others only when customers or contracts call for them: each one adds controls to operate and evidence to keep for the whole observation period.
Does a compliance automation platform replace this?
They are complementary. A platform collects evidence; we test whether the controls behind it actually work, including the ones a platform cannot see, such as physical access and how access requests are really approved.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
SOC 2 readiness
We reply within one business day.
Nothing you send is shared outside Calibre.