SOC 2
Get SOC 2-ready without stalling your roadmap
We prepare your company for its SOC 2 Type I or Type II audit, so you can say yes to enterprise security questionnaires and close deals faster.
At a glance
TypeAttestation report
Issued byIndependent CPA firm
Best forSaaS & service providers selling to US enterprises
Typical readiness8–16 weeks (Type I)
Overview
What it is
SOC 2 is an attestation report issued by an independent CPA firm under the AICPA Trust Services Criteria. Security is always in scope; Availability, Confidentiality, Processing Integrity and Privacy are added based on what you promise customers.
A Type I report evaluates whether your controls are designed properly at a point in time. A Type II report tests whether they operated effectively over an observation period, typically three to twelve months.
You need this if…
- An enterprise prospect asked for your SOC 2 report
- Security questionnaires are slowing down your sales cycle
- You bought a compliance automation tool but need someone to drive it
- Your Type I is done and the Type II observation window is coming
The Lightwork Method
How we get you there
01
Scope
Choose the right Trust Services Criteria, systems and report type for your customers.
02
Gap assessment
Compare your current practices to the criteria and prioritize what is missing.
03
Remediation
Write right-sized policies, implement controls and set up evidence collection.
04
Readiness review
A mock audit that confirms you are ready before the auditor arrives.
05
Audit support
Help selecting an auditor and hands-on support through fieldwork.
06
Stay compliant
Ongoing support between audits so the next report is routine.
Deliverables
What you walk away with
- Scoping memo and Trust Services Criteria selection
- Gap assessment with prioritized remediation plan
- Policy and procedure set tailored to your company
- Control matrix mapped to the criteria
- Risk assessment and vendor management program
- Evidence library and audit-readiness checklist
Timeline & pricing
Our fee is a fixed price for a fixed scope. The auditor’s fee and any compliance platform are separate; we help you choose both. Contact us for a fixed-price proposal.
Most companies are ready for a Type I audit in 8–16 weeks; the audit and report take another 4–6 weeks. A Type II report follows an observation period of at least three months.
From your side, plan for one internal owner with a few hours a week, and 100–300 hours across your team in the first year.
Do you perform the SOC 2 audit?
No. SOC 2 reports must be issued by an independent CPA firm. We prepare you and support you through the audit, and we can introduce you to audit partners.
Type I or Type II first?
Many companies start with a Type I to unblock deals quickly, then move to Type II. If your customers require Type II, we can plan for it directly.
Do we need a compliance automation platform?
Not always. Platforms like Vanta, Drata or Secureframe can reduce evidence work. We work with whichever you choose, or none.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.