SOC 2 Readiness
That Gets You
Audit-Ready Faster
SOC 2 Type I and Type II readiness
Prepare for a Clean SOC 2 Report, with Controls That Work in Practice
iSpyCyber helps SaaS providers and service organisations select the right Trust Services Criteria, design controls that fit how they operate and build the evidence a CPA firm will test. Our GRC specialists work alongside offensive security testers, so the controls you describe are backed by real technical assurance.
Why organisations choose iSpyCyber
Right-sized scope
We help you choose the criteria, systems and report type that meet customer demands without over-committing.
Controls that fit your stack
Controls designed around your cloud, CI/CD and identity tooling, so compliance follows how your teams already work.
Penetration testing included
Application, API and cloud penetration testing that supports your risk assessment and vulnerability management controls.
Evidence built for auditors
Evidence organised by criterion and control, so your audit firm spends less time chasing and more time testing.
Type I to Type II
A clear path from a point-in-time Type I report to operating-effectiveness evidence across a Type II observation period.
Continuous assurance
iefyx, our AI-native VAPT platform, keeps vulnerability evidence current between annual audits.
Coverage
Trust Services Criteria We Help You Meet
Security is required in every SOC 2 report. We cover the common criteria in depth and add the categories your customers expect.
Control environment
Governance, board oversight, organisational structure, hiring, conduct and accountability under CC1.
Communication and information
Internal and external communication of objectives, responsibilities and security commitments under CC2.
Risk assessment
Risk identification, fraud risk, change impact and vendor risk management under CC3 and CC9.
Monitoring activities
Ongoing and separate evaluations of controls and how deficiencies are tracked and fixed under CC4.
Logical and physical access
Identity management, MFA, access reviews, encryption and physical safeguards under CC6.
System operations
Vulnerability management, monitoring, incident detection and response, and recovery under CC7.
Change management
Controlled design, testing, approval and deployment of infrastructure and software changes under CC8.
Availability and processing integrity
Capacity planning, backups, disaster recovery and complete, accurate and timely processing.
Confidentiality and privacy
Classification, retention and disposal of confidential information, and notice, consent and use of personal information.
Methodology
A Six-Phase Path from Readiness to SOC 2 Report
Aligned to the AICPA Trust Services Criteria and the way service auditors test design and operating effectiveness.
- AICPA TSC
- SSAE 18
- COSO 2013
- NIST SP 800-115
- CIS Controls
6–12
weeks to Type I readiness
6
lifecycle phases
5
Trust Services Criteria categories
01
- Weeks 1–2
Scope and plan
System boundaries, criteria, report type and target audit timeline agreed with your leadership.
Key activities
- Define the system and its boundaries
- Select Trust Services Criteria categories
- Choose Type I, Type II or both
- Output: Scoping memo and timeline
02
- Weeks 2–4
Gap assessment
Current controls reviewed against each relevant criterion and its points of focus.
Key activities
- Interview control owners
- Review policies, tooling and records
- Rate each gap by risk and effort
- Output: Criterion-by-criterion gap report
03
- Weeks 3–6
Design controls
A control matrix and policy set designed around your tools, teams and customer commitments.
Key activities
- Build the control matrix
- Draft policies and procedures
- Define evidence sources for each control
- Output: Control matrix and policy set
04
- Weeks 5–10
Implement and test
Controls put into operation, with penetration testing and technical validation of key safeguards.
Key activities
- Guide implementation of missing controls
- Application and cloud penetration testing
- Retest and confirm technical fixes
- Output: Operating controls and test reports
05
- Weeks 9–12
Readiness review
An internal audit of design and, for Type II, early operating effectiveness, sampling as an auditor would.
Key activities
- Sample evidence against each control
- Draft the system description
- Confirm readiness for the audit firm
- Output: Readiness report and system description draft
06
- Audit and observation period
Audit support
Support through your CPA firm’s fieldwork and the Type II observation period.
Key activities
- Coordinate evidence requests with the auditor
- Monitor controls during the observation period
- Help respond to exceptions and queries
- Output: Continuous evidence calendar
Effort distribution
Where the programme time goes
Most of the effort goes into designing and operating controls that will stand up to testing. Percentages are indicative for a first SOC 2 Type I leading into Type II.
Quality built into every phase
Controls that match reality
No controls you cannot operate every day.
Sampled like an auditor
Readiness reviews test evidence the way auditors do.
Technically validated
Penetration testing backs your security claims.
Independence respected
We prepare you. Your CPA firm issues the opinion.
Engagement options
Choose the SOC 2 Support That Fits Your Stage
From a first readiness check to ongoing support across every observation period, the methodology stays the same.
Gap assessment
A review of your controls against the selected Trust Services Criteria with a prioritised remediation plan. Best for organisations deciding on scope, timing and report type.
Full readiness programme
Scoping, gap assessment, control design, policies, implementation support, penetration testing and a readiness review. Best for a first Type I or Type II report.
Ongoing compliance support
Control monitoring through the observation period, periodic internal audits, annual penetration testing and audit coordination. Best for sustaining clean Type II reports year after year.
Not sure which option you need?
Our specialists will recommend an approach based on your customers’ requirements, your architecture and your target report date.
Deliverables
Everything You Need Before Your Audit Firm Starts
Clear priorities for leadership, workable controls for engineering and organised evidence for your service auditor.
Gap report
Status against each relevant criterion, with gaps rated by risk and effort and an executive summary.
Policies and control matrix
Information security policies, procedures and a control matrix mapped to the Trust Services Criteria.
Evidence packs
Evidence organised by control, a draft system description and penetration test reports ready for your auditor.
Remediation roadmap
A sequenced plan with owners and dates, so the gaps most likely to cause exceptions are closed first.
Mapped to the frameworks your customers ask about
- SOC 2
- AICPA TSC
- ISO/IEC 27001
- ISO/IEC 27701
- PCI DSS
- HIPAA
- GDPR
- DPDP Act 2023
- NIST CSF
- CIS Controls
iSpyCyber provides SOC 2 readiness, gap assessment, implementation, internal audit and penetration testing. SOC 2 reports are issued only by licensed CPA firms, which must remain independent of the controls they test.
SOC 2 readiness for service organisations in every industry
The basics
Does iSpyCyber issue SOC 2 reports?
No. SOC 2 reports can only be issued by a licensed CPA firm under AICPA attestation standards. iSpyCyber prepares you for that audit through scoping, gap assessment, control design, implementation support, penetration testing and readiness reviews. Because auditors must stay independent, we do not act as your service auditor on engagements where we helped build your controls.
What is the difference between SOC 2 Type I and Type II?
A Type I report gives an opinion on whether controls are suitably designed at a point in time. A Type II report also tests whether those controls operated effectively over an observation period, commonly between three and twelve months. Most customers ultimately expect a Type II report.
Which Trust Services Criteria should we include?
Security is mandatory. Availability, processing integrity, confidentiality and privacy are added based on your customer commitments and the services you provide. We help you choose a scope that meets customer demands without adding unnecessary work.
Working with us
How long does it take to get SOC 2 ready?
Readiness for a Type I report typically takes six to twelve weeks, depending on your current controls. A Type II report then requires the chosen observation period before the audit firm can issue its opinion.
Do we need a penetration test for SOC 2?
The criteria do not prescribe a penetration test, but auditors expect evidence that you identify and address vulnerabilities, and customers often ask for one. Our penetration testing supports your risk assessment and system operations controls.
Do we need a compliance automation tool?
Not necessarily. Automation tools help collect evidence, but they do not design controls or fix gaps. We work with the tools you have, or help you operate without one.
Get started
Win Enterprise Trust.
With a SOC 2 Report You Can Stand Behind.
Talk to our GRC specialists about a scoped SOC 2 readiness review for your service organisation.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries