Compliance readiness for SOC 2, ISO 27001 and GDPR, with evidence your auditor can check.

Cost depends on your size, how many systems are in scope, which Trust Services Criteria you include, how many controls already exist and whether you add ISO 27001 or GDPR. Readiness is a fixed-price project, while the audit fee is paid directly to the independent auditor and compliance platforms bill you separately. You get a written scope after a free call.

The report and certificate come from independent bodies: a licensed CPA firm issues SOC 2 reports, and an accredited certification body issues ISO 27001 certificates. We prepare the controls, policies and evidence they examine and support you through the audit, which keeps the assessment independent, as both frameworks require.

A Type 1 report checks whether your controls are designed properly at a single point in time. A Type 2 report checks whether they actually operated over an observation period, usually 3 to 12 months. Many companies start with Type 1 to answer customers sooner, then move to Type 2.

Most companies are ready for a Type 1 audit in 8 to 16 weeks, depending on how many gaps the assessment finds and how quickly owners can act. A Type 2 audit then needs an observation period of several months before the auditor reports.

Choose the one your customers ask for. SOC 2 is a common request from buyers who expect an AICPA attestation report, while ISO 27001 is a certification recognized worldwide that many enterprises and public bodies prefer. The controls overlap heavily, so we design them once and map them to both.

It helps, and it's optional. Platforms such as Vanta, Drata and Secureframe collect evidence from your cloud and tools automatically and track every control in one place. For a small scope, a well-organized evidence folder with owners and a schedule can work, and we'll recommend based on your size and audit plans.

GDPR readiness covers how you collect, use and protect personal data: records of processing, a lawful basis for each use, data processing agreements, impact assessments where needed and a process for access and deletion requests. Many SOC 2 and ISO 27001 controls support it, so we build them together. Legal interpretation stays with your counsel or data protection officer.

A sponsor who can approve policies and decisions, an owner for each area such as engineering, IT and HR, and admin access to the systems in scope. Most owners spend a few hours a week during implementation, while we handle drafting, configuration and evidence setup.

Yes, on a monthly retainer we run the recurring controls with you, such as access reviews, vendor reviews and policy updates, keep evidence current and prepare you for the next audit period. That keeps a Type 2 observation window clean.