SOC 2

The readiness assessment (€539) is your first step. Remediation services run €2k–10k depending on gap size. The actual CPA audit costs $15,000–40,000. Compared to building compliance from scratch with a Big-4 firm ($80,000+), our approach delivers equivalent evidence at 60–80% lower total cost.

Type I assesses control design at a point in time (snapshot). Type II covers a 6–12 month observation period showing controls operated effectively over time. Enterprise customers require Type II; you need Type I as a stepping stone. Our assessment tells you exactly what Type I design gaps you need to close first.

Step 1: Readiness assessment (this service) — identifies all TSC gaps. Step 2: Close design gaps (policy pack, monitoring setup, access controls). Step 3: Start observation period — collect 6–12 months of evidence. Step 4: CPA Type I audit, then extend to Type II. Our SOC 2 fast-track bundle covers Steps 1–2.

Strongly recommended but not strictly mandated. SOC 2 CC4.1 (logical and physical access) and CC7.1 (system operations) both benefit from penetration testing evidence. Most SOC 2 auditors will note it as a control gap if absent. Our Standard Pentest (€4,500) produces SOC 2-ready evidence.

SOC 2 has 5 Trust Services Criteria: Security (CC1-CC9, mandatory for all), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1-P8). CC1-CC9 covers the full COSO framework: control environment, communication, risk assessment, monitoring, logical access, system operations, change management, and risk mitigation. The readiness assessment maps all applicable criteria for your services.