SOC 2 readiness
Get SOC 2 ready without stopping the roadmap
A deal is blocked on compliance and suddenly SOC 2 is on your critical path. We build the controls, write policies that match what you actually do, and set up evidence collection so your auditor has nothing to argue with.
First, the thing vendors skip
We prepare you. We cannot audit you.
A SOC 2 report is an attestation issued by an independent licensed CPA firm. That independence is gone if the same party designed and implemented the controls, which means no consultancy can honestly offer both. We do the readiness work and hand you to an auditor you choose, and we will help you choose well. If anyone offers you the full package including the report, that is the moment to leave.
The work
Eight workstreams, in this order
Scope and criteria
Which Trust Services Criteria apply. Security is mandatory, the other four are optional and each one you add is more work. Most companies should start with Security alone.
Access control
Joiner, mover and leaver processes, least privilege, MFA everywhere, and evidence that it happens rather than a policy saying it should.
Change management
Pull request reviews, approvals and deployment records that prove code did not reach production unreviewed.
Monitoring and logging
Alerting that someone actually receives, with evidence of response. Dashboards nobody opens fail this.
Vendor management
An inventory of subprocessors, their reports, and a review cadence.
Policies that match reality
Written to describe what you do. Auditors test against your own policy, so an ambitious one simply gives them more ways to find you non-compliant.
Risk assessment
A documented, repeated exercise rather than a one-off spreadsheet.
Evidence collection
Usually automated through a compliance platform, configured so the monthly burden on your team is close to zero.
Timeline
What actually happens, and when
- 01
Gap assessment
Weeks 1 to 2
What exists, what is missing, and what scope you should choose. You get a written gap list and a realistic date, before committing to the rest.
- 02
Build the controls
Weeks 3 to 10
Access control, change management, monitoring, vendor management. This is engineering work, which is why an engineering firm is a reasonable place to buy it.
- 03
Policy and evidence
Weeks 8 to 12
Policies written to match what you do, and automated evidence collection so the monthly load on your team stays near zero.
- 04
Auditor handoff
Week 12 onward
We brief your auditor, answer their questions and fix what they flag. Type I can follow quickly. Type II needs an observation window of at least three months.
Readiness engagement
$8,000–$20,000fixed scope
Depending on scope and what already exists. Your auditor and your compliance platform are paid separately and directly by you, and we will give you realistic ranges for both during scoping.
Book a scoping callFAQ
Common questions
Can you be our auditor as well?
No, and nobody who prepared you can be. A SOC 2 report is issued by an independent licensed CPA firm, and that independence is void if the same party designed or implemented the controls. We get you ready and brief your auditor. If a vendor offers to do both, that is a reason to walk away.
Type I or Type II?
Type I says your controls are designed correctly at a point in time. Type II says they actually operated over a period, usually three to twelve months. Most enterprise buyers want Type II eventually, but Type I is often enough to unblock a deal now while the Type II observation window runs.
How long does the whole thing take?
Readiness work is typically eight to twelve weeks depending on how much exists already. Then Type I can follow quickly, while Type II requires an observation window of at least three months before the auditor can report. Anyone promising SOC 2 in four weeks is describing Type I on a very small scope.
Do we need a compliance platform like Vanta or Drata?
Usually yes, and we work with whichever you choose. They automate evidence collection, which is the part that otherwise consumes your team every month. They do not do the hard part, which is designing controls that fit how you actually work rather than how the template assumes you do.
What does it cost in total?
Our readiness work is 8,000 to 20,000 USD depending on scope and what you already have. On top of that, budget for the auditor and the compliance platform, both paid directly by you. We will give you realistic ranges for both during scoping so there are no surprises.
We are five people. Is SOC 2 realistic?
Yes. Scope is the lever. A small team with a tight scope and few systems can get through this, and the discipline is easier to build now than to retrofit at fifty people. What is not realistic is treating it as a document exercise, because Type II tests whether you really did the thing every month.
Let's talk
Tell us what you're building.
Get a free 30-minute strategy call. You'll leave with a clear plan, a realistic estimate and our honest opinion — whether or not you work with us.
- Email usmail@voliom.com