Skip to main content
VexaroSecurity
SOC 2 readiness

SOC 2 readiness & audit support

SOC 2 is an attestation issued by an independent CPA firm, and no consultancy can hand it to you. What we do is get you ready for it: a gap assessment against the AICPA Trust Services Criteria, the controls and evidence to close those gaps, and the penetration test your report rests on. The audit itself is performed by a licensed CPA.

Scope

What readiness covers

SOC 2 reports on a service organisation's controls against the AICPA Trust Services Criteria (TSC): Security (the mandatory Common Criteria), plus Availability, Processing Integrity, Confidentiality and Privacy as you choose. We help you scope the right criteria, then close the gap between today and an auditable control set.

Typical scope
  • Scoping the system description and which Trust Services Criteria apply
  • Gap assessment of controls against the Security Common Criteria (CC1-CC9)
  • Optional categories: Availability, Processing Integrity, Confidentiality, Privacy
  • Policies, procedures and the evidence/control narratives an auditor expects
  • Penetration testing as technical evidence for the Common Criteria
  • Type I (design at a point in time) vs Type II (operating effectiveness over a period)
How we work

Readiness first, then the audit

We prepare you for the audit; we are not your auditor. The two roles are kept separate on purpose, because the CPA firm must be independent. We run the gap assessment and remediation, you go into the examination prepared, and the CPA performs it and issues the SOC 2 report. We can recommend audit firms but never issue the attestation ourselves.

  1. 1

    Scoping

    We agree the system boundary, the Trust Services Criteria in scope and Type I vs Type II, and sign an NDA.

  2. 2

    Gap assessment

    We measure your current controls against the Common Criteria and any chosen categories, and prioritise the gaps.

  3. 3

    Remediation

    We help you build the missing controls, policies and evidence, and run the pentest the report depends on.

  4. 4

    Audit support

    We prepare you for the examination and support you through the independent CPA firm's fieldwork.

  5. 5

    Type II observation

    For Type II, controls must operate over a period (usually 3-12 months). We help you keep them running and collect the evidence.

Deliverables

What you receive

A readiness report plus the technical evidence package: what you need to go into the examination prepared. The SOC 2 report itself comes from the CPA firm, not from us.

What you get
  • Gap assessment report mapped to the Trust Services Criteria
  • Prioritised remediation plan with owners and effort estimates
  • Control narratives, policy templates and an evidence checklist
  • Penetration test report (CVSS 3.1, PoC, reproduction) as Common-Criteria evidence
  • Readiness sign-off indicating you are prepared for the examination
  • Free re-test of remediated technical findings before the audit window, as scheduled in the SoW
Methodology & standards

Grounded in the AICPA Trust Services Criteria

AICPA TSCSOC 2 Type I / IICommon CriteriaOWASP WSTGCVSS 3.1Independent CPA audit

Readiness is mapped to the AICPA Trust Services Criteria: Security (the mandatory Common Criteria) plus Availability, Processing Integrity, Confidentiality and Privacy as selected. A SOC 2 examination must be performed by an independent licensed CPA firm. We provide readiness, gap assessment, remediation and the supporting penetration test, but we are not a CPA firm and do not issue the SOC 2 report or attestation. Type II also requires controls to operate over an observation period.

Get ready for SOC 2.

Tell us your system boundary and the report type you're aiming for. We'll scope the readiness work, run the gap assessment and pentest, and prepare you for an independent examination, all under NDA. The first consultation is free.