SECURITY AND COMPLIANCE
SOC 2 readiness: what it actually takes
The certificate is obtainable. Controls that stay true between audits are the harder and more valuable thing.
SERVICE 04
Pass the audit without becoming a paperwork company.
Hardening, gap assessments and readiness work for SOC 2, ISO 27001 and similar — aimed at controls that match how your team genuinely operates, because the other kind stops being true the week after the audit.
THE PROBLEM
Compliance theatre passes once and protects nothing
It is entirely possible to pass an audit with policies nobody follows and controls that exist for the auditor. It costs a great deal, improves nothing, and has to be repeated from scratch every cycle.
Controls that match how people already work survive. That means changing some of how the team works and changing some of the proposed controls, and it is slower at the start than writing the policies somebody else wrote.
WHO IT IS FOR
Who security and compliance is designed for
Teams with a deal on hold
An enterprise customer wants a report before signing, and there is a date attached.
Teams facing first-time certification
Nobody internally has been through it and the quotes vary wildly.
Teams with findings to fix
A pen test or an audit produced a list and it is not obvious what matters.
Teams growing past informal
Access and change control used to be fine because everyone knew everyone.
WHAT IT INCLUDES
What this work may cover
Not every engagement covers all of it. The shape depends on what you are deciding.
Gap assessment
Where you are against the specific standard you need, with no padding.
Remediation
The technical fixes, prioritised by real risk rather than by severity label.
Control design
Controls built around your existing workflow so they stay true between audits.
Evidence automation
Collection that runs itself, so the next cycle is not another scramble.
Audit support
Working alongside your auditor, which we are not and will not pretend to be.
THE FRAMEWORK
How the work is sequenced
- 01
Scope the standard
Which framework, which controls, and what the customer actually asked for.
- 02
Assess
Honest gap analysis, including the parts that are further off than hoped.
- 03
Fix what matters
Real risk first, then the findings that are only findings.
- 04
Design controls that fit
Matched to how the team works, so they remain true unattended.
- 05
Automate the evidence
So the next cycle costs a fraction of this one.
ILLUSTRATIVE EXAMPLE
A company told it needs SOC 2 Type II before a contract closes
A constructed example to show the shape of the work, not a client case study.
- 1
Check what the customer actually requires. Sometimes it is Type I, or a questionnaire, and the timeline changes completely.
- 2
Run the gap assessment and accept the uncomfortable parts of it early.
- 3
Fix access control and change management first — the two that fail audits most often.
- 4
Design the evidence collection before the observation window opens, not during it.
- 5
Support the audit, then leave the controls running without anybody babysitting them.
RELATED READING
Worth reading alongside this
CLOUD AND INFRASTRUCTURE
The cheapest fix is usually configuration
Before the architecture conversation, check the settings. A surprising share of production pain is a default nobody changed.
WORKING TOGETHER
How to brief a consultancy
The brief determines the outcome more than the firm does. Bring the problem, not the solution.
QUESTIONS
Common questions about this work
Can you certify us?
No. Certification comes from an accredited auditor, and the same firm cannot both prepare you and issue the opinion. We do the readiness work and support you through the audit; the opinion is theirs.
How long does SOC 2 take?
It depends on your starting point and the type. A Type II needs an observation window of several months on top of remediation, which is why the deal timeline usually needs discussing honestly and early.
Is a compliance platform enough on its own?
The tooling helps with evidence and is genuinely useful. It does not do the remediation, and it will happily automate the collection of evidence for a control that nobody follows.
Find out how far off you are
A gap assessment turns an unknown deadline risk into a list with dates on it.