SOC 2 readiness
The auditor issues the report and the deal stops waiting.
$2,250 for the readiness sprint · from $6,720 for Type 1.
How many deals are stuck on the line 'we need SOC 2'?
Usually one — and it is the biggest. The demand comes from the client's procurement team, they set the deadline, and nobody inside your company can waive it. Then the hunt starts: what is this thing, who issues the report, and why do the figures online differ twentyfold.
A report your client will accept
First we look at what the client and the auditor will check and what you do not have today. That is the readiness sprint: it ends with a list of work, a deadline and a price, not with a 'not bad overall'.
Then we assemble everything the auditor will ask to see: written policies, how access is granted and removed, how breaches are handled, and the place where all this paperwork lives. We pick the auditor ourselves and deal with them until the report is issued.
Type 2 differs from Type 1 only in time: it proves the rules held for months. So after Type 1 we stay on and collect the paperwork ourselves.
What the preparation covers
- included: What is missing and which requirements will land in your audit
- included: Policies and procedures on paper, not by word of mouth
- included: One place holding every document and settings screenshot
- included: How access is granted and removed, how breaches are handled
- included: Choosing the auditor and dealing with them until the report is issued
- included: Answers to client questionnaires while you get ready
- included: GovRAMP readiness on the same requirements
- paid to the vendor: The auditor's fee, licences and GovRAMP charges are billed by the supplier
Your price
Readiness sprint
$2,250 per sprint
What is missing, the deadline and the price of the work.
What the tier includes
- included: A breakdown of what is missing and a work plan with a price
Type 1 programme
from $6,720 for 30 days
Sixty hours to audit readiness.
What the tier includes
- included: Policies, paperwork, settings screenshots and support up to the report
Type 2 support
$2,250 a month
Between audits we hold it all together.
What the tier includes
- included: We collect the paperwork, answer questionnaires and prepare the next audit
Extras
- not included: External pen test to meet the auditor's requirementfrom $4,480
- not included: Questionnaires your client has sent$1,350 per questionnaire
- not included: We watch for attacks around the clock$18 per endpoint a month
- not included: Fractional chief information security officerfrom $2,500 a month
- not included: Preparing for a cyber policy renewal$2,250 one-off
- not included: If you are breached, we investigate — monthly$670 a month
- not included: CMMC readiness for defense contractorsfrom $3,360
- not included: Patient records kept protected+$40 per seat a month
Questions
How long does it take from start to report?
Type 1 takes thirty days of preparation plus the auditor's own timeline. Type 2 adds an observation window set by the auditor: usually three months or more. You get the exact number in the first week, out of the readiness sprint.
Why do market prices differ twentyfold?
Because three separate bills get rolled into one figure: our work, the software licence and the auditor's fee. We keep them apart: you pay the software and the auditor direct, with no mark-up from us.
Is Type 1 enough for us, or do we need Type 2 straight away?
Look at the client's email: it almost always says which report they accept and by when. If it just says 'SOC 2', start with Type 1 — it is also the first half of the road to Type 2.
Our client is a government body and they are asking for GovRAMP.
The requirements are almost the same, so the work is done once and covers both. You pay the GovRAMP operator's charges direct: they are not in our price, and we name that line of the bill up front, not at the end.
Name the client asking for the report and their deadline — we will email you a quote and a plan.
We have your request
We answer during the hours listed in the contacts at the foot of the page. The quote and the conversation come first — nothing is signed and nothing is charged.