Scope and ownership
System boundary, applicable criteria, services, data, vendors, control owners and an achievable examination path.
SOC 2 readiness
Build the controls before collecting the screenshots.
We help software companies turn Trust Services Criteria into day-to-day engineering and operating controls. Evidence becomes a by-product of the work, not a last-minute scavenger hunt.
01 / Readiness work
Make the control true before making it tidy.
Policies matter, but the hard work is usually access, change, monitoring, vendors and evidence. We keep the control language close to what your team actually does.
Technical controls
Cloud access, secure change, vulnerability handling, logging, backup, recovery and incident procedures.
Operational controls
Joiner-mover-leaver, access reviews, vendor review, risk treatment, training and management oversight.
Evidence and exceptions
Evidence sources, collection cadence, sample readiness and a clear path for control failures and deviations.
02 / Method
Work backwards from repeatable evidence.
One perfect screenshot proves little. We design controls a team can perform consistently across the examination period and explain to an auditor.
Set the boundary
Agree scope, criteria, system description inputs, owners, deadlines and the independent auditor relationship.
Close the gaps
Implement and document controls, prioritising technical gaps that need lead time or behaviour change.
Run the control
Collect evidence on schedule, inspect exceptions and prepare owners to explain how the control operates.
03 / Outputs
- 01Scoped readiness plan and control-owner map
- 02Gap register with technical remediation work
- 03Policies and procedures matched to actual practice
- 04Evidence matrix and collection workflow
- 05Readiness review before the examination period
Start before the evidence window starts.
Tell us the deadline and what already exists.
Plan SOC 2 readiness →