SOC 2 Type I & Type II
SOC 2 without the guesswork.
We scope the trust criteria, close the gaps, collect the evidence and sit beside you through fieldwork. You walk into the audit already knowing the answer.
SaaS and service companies whose customers ask for a SOC 2 report before they sign.
app.resilientprivacy.com/grc/soc-2
Simulated environment, real workflow.
Control readiness
Know how many controls pass before the auditor does.
Automated tests run against every control we can check from your systems. Failing ones arrive with an owner and a fix, so the audit window holds no surprises.
- Passing 82
- Failing 3
- Not yet tested 4
| Status | Count | Share |
|---|---|---|
| Passing | 82 | 92% |
| Failing | 3 | 3% |
| Not yet tested | 4 | 4% |
Simulated environment, real workflow.
Where AI lands in SOC 2.
Shipping AI features? We scope model providers, prompts and training data into the system description, so the report covers what customers now ask about.
How readiness works
Five steps from first call to audit-ready.
- 01
Scope
Pick the trust services criteria, systems and Type I or Type II based on what your customers actually need.
Output: Scope memo
- 02
Gap assessment
Map your current controls to the criteria and rank the gaps by audit risk and effort.
Output: Gap register
- 03
Remediate
Write the policies, set up the controls and connect evidence sources so nothing is screenshots in a folder.
Output: Policies and controls
- 04
Observation window
Run the controls, review evidence monthly and fix drift before an auditor finds it.
Output: Evidence log
- 05
Audit support
Coordinate the independent auditor, answer requests and manage fieldwork through to the final report.
Output: Auditor request list
Deliverables
What you keep when we are done.
Documents and systems your team owns and runs, not a binder that goes stale.
- Scoping memo and system description draft
- Gap assessment with a prioritized remediation plan
- Policy and procedure set mapped to the criteria
- Control matrix with owners and evidence sources
- Evidence library ready for auditor requests
- Auditor coordination through the final report
Typical timeline
Varies with scopeScope and gaps
Weeks 1–3
Workshops, system inventory, gap report.
Remediation
Weeks 3–10
Policies, controls and evidence automation.
Type I or window opens
Week 10+
Point-in-time audit or start of the Type II observation period.
Type II report
3–12 month window
Fieldwork support and report delivery by the auditor.
FAQ
Straight answers.
Type I or Type II?
Type I checks design at a point in time; Type II checks that controls ran over a period. Most enterprise buyers ask for Type II. A Type I can unblock deals sooner.
Do you issue the SOC 2 report?
The report is issued by an independent licensed CPA firm. We prepare you and coordinate the audit.
Which trust criteria do we need?
Security is always in scope. Add Availability, Confidentiality, Processing Integrity or Privacy only when customers or contracts require it.
Can we reuse this for ISO 27001?
Yes. Most SOC 2 controls map to ISO 27001 Annex A, so the second framework costs a fraction of the first.
Related
Often paired with.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.