SOC 2 READINESS: Prepare for the examination your customers are asking for.
SOC 2 readiness prepares your systems, controls and evidence for examination by an independent CPA firm. We help define the system and relevant criteria, address control gaps and establish evidence collection, including the operating records needed for a Type 2 report covering a specified period.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
Set the scope before building the evidence.
A customer's request for “SOC 2” leaves important choices unresolved: which service the report should describe, which trust services categories matter and whether they need Type 1 or Type 2. Those choices affect the controls, evidence and time involved. We help clarify them before preparation gathers momentum in the wrong direction.
Where it fits
- A prospective customer has requested a SOC 2 report before procurement can progress.
- Your controls exist, but ownership and supporting records are inconsistent.
- You have a Type 1 report and need to prepare for an operating period, or your service has changed since the last examination.
Connect what you promise with what you can demonstrate.
System and reporting scope
Define the service, system boundaries, commitments, relevant trust services categories and intended report type; confirm the examination scope with the independent CPA firm when appointed.
Control design and gaps
Review how controls address the applicable criteria, who performs them and whether the procedures match the system being described.
Operating evidence
Establish the records and recurring activities needed to support the examination, such as access reviews, change approvals, monitoring and supplier reviews where applicable.
Examination preparation
Support the system description, evidence organisation, readiness review and responses to requests from the independent examiner.
Preparation has to reach everyday work.
We review current practices and records, then build a remediation plan around the agreed scope. Control owners need workable procedures and a clear record of completion. For Type 2 preparation, we help track the recurring activities and exceptions across the intended period, so missing evidence is identified while there is time to address the underlying process.
What you receive
Scope and control map
The system boundary, relevant criteria, responsibilities and existing gaps.
Remediation work plan
Changes to implement and the evidence each control should produce.
Readiness record
Organised supporting material, outstanding exceptions and preparation for the examiner's requests.
What is the difference between Type 1 and Type 2?
Both report types address the description of your system and the suitability of control design. Type 1 relates to a specified date; Type 2 also examines operating effectiveness over a specified period. Customer requirements and your preparation help determine the appropriate route.
Does Subdux issue the SOC 2 report?
No. We provide readiness and implementation support. An independent CPA firm performs the examination and issues its report. Their scope, testing and conclusions remain independent.
Do we need a compliance platform?
A platform can help organise controls and evidence, but it does not perform the underlying activities for you. We can work with your existing approach and establish what additional tooling, if any, is useful.
How long will preparation take?
Preparation depends on the scope, current controls, required changes and the people available to complete the work. Type 2 also needs an operating period for the examiner to assess. We account for these factors and the examining firm's schedule before setting preparation milestones.
What exactly has your customer asked to see?
Bring the request, your current control documentation and any intended examination dates. We can help establish the preparation involved.
Related services: ISO/IEC 27001:2022 and IT General Controls Audit.