SOC 2 compliance, run end to end
From readiness assessment to your Type II report: we scope the Trust Services Criteria, build and evidence the controls, and sit with you through the examination with your CPA firm. Fixed consulting fee agreed up front.
What is SOC 2?
SOC 2 is an independent attestation report, issued by a licensed CPA firm under AICPA standards, on how a service organisation's controls meet the Trust Services Criteria: Security (always required) plus optional Availability, Processing Integrity, Confidentiality and Privacy. A Type I report covers control design at a point in time; a Type II report covers operating effectiveness over a period, typically three to twelve months.
Who this is for
When SOC 2 compliance is the ask
SOC 2 is usually a commercial requirement before it is a security one. If any of these sound familiar, this is the engagement.
A US enterprise customer has made a SOC 2 report a condition of signing.
Procurement teams keep sending security questionnaires that a SOC 2 report would answer in one document.
You are expanding into North America and SOC 2 is the framework buyers there recognise.
An investor, acquirer or insurer wants independent assurance of your security controls.
You already hold ISO 27001 and customers are now asking for SOC 2 as well.
What you receive
What the engagement includes
Everything your CPA firm will examine, built and evidenced before they arrive.
Readiness & gap assessment
A benchmark of your current controls against the Trust Services Criteria, ranked by what blocks the report, what carries real risk and what is merely tidy. The fixed-fee quote for the build follows from this.
Scope & criteria selection
A defensible system description and the right criteria: Security is always required, and we scope Availability, Processing Integrity, Confidentiality and Privacy from what your customers actually ask for. Scope is the decision that most affects audit effort and cost.
Control design & implementation
Policies and controls designed for your environment rather than a template, mapped to the common criteria, implemented with named owners so they survive staff changes.
Evidence collection
Evidence processes set up to run continuously through the observation period, not assembled in the fortnight before the auditor arrives. Type II lives or dies on evidence.
Staff awareness & ownership
Awareness training so the controls keep operating outside audit season. CPA firms interview your staff, and prepared staff are the difference between a smooth examination and a painful one.
Type I & Type II audit support
We shortlist and brief the CPA firm, sit in the examination with you, and manage any exceptions through to the issued report.
The process
How the engagement runs
Elapsed time to a Type II report is driven mainly by the observation period you choose, typically three to twelve months once controls are operating. A Type I report can come much earlier.
Weeks 1–3
Readiness assessment
We benchmark your current state against the Trust Services Criteria and rank what blocks the report, what carries real risk, and what is merely tidy. The fixed-fee quote for the build follows from this.
Weeks 3–8
Scope & design
System description, criteria selection, control design and the policy set, matched to how your organisation actually operates.
Months 2–4
Implementation & evidence
Controls go live with named owners, and evidence collection starts running, implemented with your team and your IT provider rather than around them.
Optional milestone
Type I report
Your CPA firm examines control design at a point in time. Many organisations use Type I as an early proof point for customers, then roll straight into the Type II observation period.
Months 4 onwards
Type II observation & report
The controls operate over a period of typically three to twelve months. Your CPA firm then tests operating effectiveness and issues the Type II report.
Already certified to ISO 27001? The SOC 2 and ISO 27001 control sets overlap heavily, so much of what you built for your ISMS maps straight across. We assess what carries over before scoping any new work, and our ISO 27001 certification service runs the certification side if you need both.
Pricing
What SOC 2 compliance costs
One fixed consulting fee, quoted in writing after the readiness assessment. No hourly billing.
The total cost of SOC 2 has three lines, and only one of them is ours: our fixed consulting fee, the CPA firm's audit fees (paid to them, varying by firm and scope), and your own team's time. The observation period you choose for Type II also affects the audit fee, so we scope criteria and period with you before any quote.
The consulting fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan and a fixed quote for the build. If you want a read on where you stand first, the free cybersecurity gap assessment takes a few minutes.
Independence
The CPA firm issues the report. We get you ready for it.
Consultants prepare you; a licensed CPA firm examines you. SOC 2 is an attestation under AICPA standards, so only a licensed CPA firm can perform the examination and issue the report. The two roles are kept separate so the report means something, and we never issue reports ourselves.
We help you shortlist CPA firms by sector experience, scope fit and availability against your deadline, brief the one you pick, and sit with you through the examination until the report is issued. Our SOC 2 framework guide explains what the auditor tests at each stage.
Why CyberNinja
Why organisations choose us
Auditors design your controls
Our consultants hold ISO/IEC 27001:2022 Lead Implementer and Lead Auditor certifications, so controls are designed the way an auditor will test them.
Build once for SOC 2 and ISO 27001
The SOC 2 and ISO 27001 control sets overlap heavily. If you need both, we design the controls once and evidence them against each framework, instead of running two programmes.
Independent advice
We hold no reseller agreements and take no vendor margin, and we never issue the report. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the readiness assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the framework itself first? Our SOC 2 framework guide explains the Trust Services Criteria and what an examination must show, the guide on SOC 2 or ISO 27001 covers how the two fit together, and our ISO 27001 framework guide covers the certification side.
FAQ
SOC 2 compliance FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready for your SOC 2 report?
Tell us who is asking for SOC 2 and when they need it. We will scope the work and give you a fixed price, so you know the cost before you commit.