S.01One‑time · fixed fee
SOC 2 readiness assessment
A senior‑led gap assessment against the Trust Services Criteria, with a defensible path to a clean Type I or Type II.
✓Gap assessment across all in-scope criteria, control by control✓Control matrix tying each control to its owner and evidence✓Evidence‑requirements map for the full window✓Scope and system‑description review of your boundary✓Prioritized remediation roadmap with owners and dates
2–4 WEEKSSOC 2 TSCGAP SPRINT →
S.02One‑time · per report
SOC 2 system description & control matrix
Section 3 written to the AICPA description criteria, with a matrix that agrees with it artifact by artifact.
✓Section 3 drafted or rewritten to every required element✓Boundary definition: products, environments, entities✓Subservice organizations, carve‑out or inclusive, handled explicitly✓Complementary user entity controls stated properly✓Consistency review against policies and platform config
2–3 WEEKSDC 200 / AT‑C 205SEE SERVICE →
S.03Annual program
Outsourced ISO 27001 internal audit
A standing, independent internal audit function that satisfies Clause 9.2 and gets your ISMS through Stage 2.
✓Annual audit program covering Clauses 4–10, the SoA, and Annex A✓Multiple cycles across the year, weighted to higher risk✓Nonconformity register and corrective actions tracked to closure✓Clause 9.3 management review support, Stage 1, Stage 2, surveillance prep✓Annual readiness statement to leadership
12‑MONTH TERM27001 / 27017 / 27018 / 27701ASSURANCE PROGRAM →
S.04Per audit cycle
ISO 27001 internal audit report
One scoped cycle with the complete record a certification body expects to read.
✓Audit plan, criteria, and sampling method documented up front✓Interviews and evidence sampling, recorded artifact by artifact✓Findings classified: major, minor, observation, opportunity✓Root cause and corrective action plan per finding✓Management‑review‑ready summary under Clause 9.3
3–5 WEEKSCLAUSE 9.2SEE SERVICE →
S.05Monthly retainer
Evidence Engine retainer
We carry your evidence across the whole audit window so nothing is missing when fieldwork starts.
✓Operating‑effectiveness monitoring across the full period✓Evidence repository with chain of custody and period tagging✓Monthly or quarterly review cycles with gap closure✓Mock fieldwork dry run before your auditor arrives✓Direct liaison with your attestation auditor or certification body
MONTHLY OR QUARTERLY3–12 MONTH WINDOWEVIDENCE ENGINE →
S.06Scoped, then retainer
SOC 2 audit rescue
Exceptions, a qualified opinion, or an audit going sideways: the defensible path back to a clean report.
✓Root cause analysis on every finding✓Remediation action plan with owners, dates, and required evidence✓Independent verification that each corrective action worked✓Re‑test plan, new sample, and bridge‑letter support✓Mock fieldwork before the re‑audit
6–12 MONTH RECOVERYANY FRAMEWORKAUDIT RESCUE →