Home / Assessments / SOC 2 readiness
SOC 2 readiness
Enterprise customers want your SOC 2 report before they sign. We find your gaps against the Trust Services Criteria, fix them with you and get you through the audit.
A Fortify Experts SOC 2 readiness assessment measures your controls against the AICPA Trust Services Criteria, delivers a remediation plan and prepares you for a Type I or Type II audit by an independent CPA firm. Pricing is quoted to scope.
From gap to report
- Scope. Systems, services and which Trust Services Criteria apply.
- Gap assessment. Your current controls against the criteria, with evidence reviewed.
- Remediation. Policies, control fixes and evidence collection, often automated in Vanta.
- Audit. We coordinate with your CPA firm and stay with you until the report is issued.
Questions we hear
What is the difference between SOC 2 Type I and Type II?
A Type I report covers the design of your controls at a point in time. A Type II report covers whether they operated effectively over a period, usually several months to a year. Most enterprise customers ask for Type II.
Which Trust Services Criteria do we need?
Security is required in every SOC 2 report. Availability, confidentiality, processing integrity and privacy are added when your customers or services call for them.
How long does SOC 2 readiness take?
A typical readiness program runs about 12 weeks before the audit window opens, depending on your starting point.
Find out where you stand in one hour
Book a free security strategy consultation. You’ll talk with a senior advisor, not a salesperson, and leave knowing which next step fits.