The report your enterprise customers ask for
Type II is not a point-in-time test. Your controls have to operate, and be evidenced, across an observation window. We get them working before the clock starts.
An attestation, not a certification
SOC 2 is a report issued by a CPA firm against the AICPA Trust Services Criteria. Type I says your controls are designed properly on a given date. Type II says they actually operated over a period — which is what buyers want to see.
- Security is mandatory; availability, confidentiality, processing integrity and privacy are chosen based on what you promise customers
- The observation window commonly runs from three to twelve months
- Evidence is sampled across the whole window — a control that lapsed for a month will show
- The output is a report you share under NDA, not a logo you publish
- It is renewed annually, so the controls have to keep running
Ready before the window opens
1. Criteria selection
Which Trust Services Criteria you actually need, based on what your contracts and customers require. Adding categories you do not need is a common and expensive mistake.
2. Readiness assessment
A gap assessment against the criteria, with each control mapped to the evidence that will have to exist every month.
3. Remediation
Access reviews, change management, monitoring, incident response, vendor management, backup and recovery. Built so that producing evidence is automatic, not a monthly scramble.
4. Type I, if it helps
Where a customer needs something now, a Type I gives you a defensible report while the Type II window runs.
5. Through the window
We run monthly evidence collection and internal checks so a lapse is caught in week two, not by the auditor in month nine.
6. Audit support
We work alongside your auditor, answer the technical requests and produce the samples.
Common questions
How soon can we have a report?
Readiness plus a three-month window is the fastest realistic route, and only if remediation is quick. Most organisations should plan for six to nine months to a first Type II.
Can you issue the report?
No. Only a licensed CPA firm can. We prepare you, run the window, and support the audit.
We already have ISO 27001. Does that count?
It helps a great deal — much of the control work maps across — but it is not a substitute. Customers asking for SOC 2 usually want the report itself.
What breaks a Type II most often?
Evidence gaps. The control existed, but nobody kept the record for the month the auditor sampled. That is exactly what the monthly cycle is for.
Plan the window before you open it.
Talk to an engineer about what your customers are actually asking for, and the shortest honest route to it.
02 3537 5791