SOC 2, without hiring a security team.

• A cloud-hosted software company with a handful of employees.
• A deal, customer, or procurement review is driving the SOC 2 deadline.
• Someone internal has time to implement changes, or can be given it.
• You want a plan and documentation you own, not a subscription you rent.

• You need a named officer or full security leadership in place.
• You need monitoring, on-call incident command, or forensics.
• The deadline is already impossible and nobody is available to implement.
• You are looking for a certificate rather than a working program.

Qualify and scope

Short call, then an intake questionnaire. You get a written scope outline and a fee estimate before anything starts.

Assess and plan

Interviews, a bounded review of architecture and existing evidence, control findings, and a risk register. Then we settle scope, report type, observation period, and a 30/60/90 backlog with named owners.

Build and operate

Policies tailored to how you actually work, procedures, a control matrix with owners and frequencies, and a way to collect evidence as you go. We check that the evidence would hold up for the period being examined.

Audit support and handover

Auditor request tracking, evidence packaging, and help drafting the system description. Then a program runbook, open risks, the next-due calendar, and access revoked. The CPA firm issues the report.

SOC 2 readiness assessment

The paid diagnostic. Where you fall short of the criteria, what it will take to reach the milestone you have in mind, and in what order. Includes the gap assessment, an initial risk register, and a readout.

Scoped program build

Policies, procedures, control design, and the first operating activities, quoted against the backlog the assessment produced. Any technical implementation we perform is enumerated line by line.

Security advisory

Bring a decision and get a straight answer: control design, access models, vendor risk, cloud configuration questions, a policy you are unsure about. Pre-authorized hour blocks available.

Light compliance maintenance

Keeping the program current after handover: access reviews, vendor checks, policy review dates, evidence quality, and the annual refresh. Compliance upkeep, not security leadership.

Customer questionnaire support

We answer the security questionnaire holding up your deal, with evidence behind each answer, and leave you an answer library you can reuse. Large procurement exercises are scoped separately.

Auditor selection and audit support

Shortlisting firms, comparing proposals, confirming scope and reporting period before you commit, then coordinating requests and evidence through fieldwork.

Named independent reviewer

Some controls need a reviewer who is not the person doing the work. We can hold that role for governance and access reviews, as an outsourced provider you disclose to your auditor. We do not review our own build work as independent.

• Assessment and findings
• Control and policy design
• Only the implementation named in scope

• Approving priorities and budget
• Accepting or treating risk
• Operating your assigned controls

• Performs the SOC 2 examination
• Forms an independent opinion
• Issues the report

SOC 2 is not a certification anyone can issue you, and readiness does not assure an unqualified report.