SOC 2 · Type 1 and Type 2
SOC 2 readiness that wins the contract, not just the report.
Enterprise and government buyers ask for SOC 2 before they sign. We scope the trust criteria your buyers actually want, close the gaps, draft the policies, run the evidence vault and hand a clean package to the auditor. Type 1 unblocks the deal in weeks; Type 2 proves it held for the period.
Fixed fee
Scoped in a 30-minute call. No surprises after.
4 to 8 weeks
Type 1 readiness: 4 to 8 weeks · Type 2 window: 3 to 12 months of monitored operation
8
named deliverables, listed below
Who it is for
SaaS, AI and technology companies of 5 to 300 people, and professional firms whose clients require it
Run by CRISC and CISA certified practitioners who have sat on both sides of the audit table.
What you get
- Scoping session: which Trust Services Criteria your buyers require (Security plus Availability, Confidentiality, Processing Integrity or Privacy)
- Gap assessment against the criteria with a risk-ranked remediation plan
- Full policy set drafted for you and adopted with your team
- Evidence vault connected to your cloud, identity, endpoints and code pipeline
- Vendor and risk register, access reviews and change-management rhythm established
- Auditor selection and handoff; we sit in the audit with you
- Type 2 monitoring for the observation period, with drift alerts before they become exceptions
- 24/7 managed protection included for the readiness period
Compare
Type 1 or Type 2: which do you need?
| SOC 2 Type 1 | SOC 2 Type 2 | |
|---|---|---|
| What it proves | Controls are designed and in place at a point in time | Controls operated effectively over a period (3 to 12 months) |
| Time to earn | Weeks, once gaps are closed | The observation period plus the audit |
| Who accepts it | Most mid-market buyers as a first step | Enterprise and government procurement as the standard |
| Best use | Unblock a live deal now | Become the default vendor choice |
| Our path | Readiness in 4 to 8 weeks | Roll straight into the Type 2 window from Type 1 |
Questions
Straight answers.
How much does SOC 2 cost?
Two costs: readiness (our fixed fee, scoped in a 30-minute call around your size and criteria) and the auditor’s fee for the attestation. We help you select an auditor whose fee fits, and we do not mark it up.
Can we skip Type 1 and go straight to Type 2?
Yes, if no deal is waiting. Most companies earn Type 1 first because it unblocks a customer within weeks, then continue into the Type 2 observation period without any rework.
Do we keep the platform after the audit?
That is the point. Continuous monitoring keeps the next Type 2 a formality and reuses the same evidence for ISO 27001 or ISO 42001 when a buyer asks.
Start here