ATTESTATION · CONSULTING SERVICES
Prove the controls worked all year, not just today
A Type II report tests whether your controls operated effectively across an observation window, not whether they existed on the day someone looked. This gets the control set designed and implemented, the evidence collection running through the window, and the attesting audit firm coordinated — the independent assurance that unlocks enterprise and international deals.
ENGAGEMENT AT A GLANCE
FrameworkAICPA Trust Services Criteria
Report typeType II — operating effectiveness
OutputImplemented controls + evidence programme
YOU RECEIVE
Trust Services Criteria scoping and control mapping
Control design and implementation against every selected criterion
Structured evidence collection through the observation window
Readiness assessment before the window opens
Coordination with the attesting audit firm through fieldwork
WHAT'S COVERED
Scope of the engagement
01
Criteria selection
Security is mandatory. Availability, confidentiality, processing integrity and privacy are each a deliberate choice, because everything you add gets audited.
02
System description
The narrative your auditor tests everything else against — boundaries, subservice organisations, and the complementary controls your customers must run.
03
Control mapping & gap review
Each selected criterion mapped to a control and assessed as designed, partially designed or absent, with the supporting evidence noted.
04
Control implementation
The missing controls designed and put in place with their owners, finished before the observation window opens — a control fixed halfway through it failed for the first half.
05
Evidence programme
What has to be captured, by whom and how often, so the window produces a complete population rather than a scramble at the end.
06
Fieldwork support
Sample requests, walkthroughs and auditor questions handled alongside your team, in direct coordination with the attesting firm.
COMMON QUESTIONS
Before you ask
Do you issue the report?
No. A SOC 2 report is issued by a licensed CPA firm and we are not one. We get you ready, implement the controls, run the evidence programme with you, and coordinate directly with the attesting firm through their fieldwork.
Should we do Type I first?
Type I tests design at a single point in time and can be a useful staging post when a customer needs something quickly. Type II tests operating effectiveness across a window and is what most buyers are actually asking for.
How long should the observation window be?
That is a conversation with your auditor and your customers — commonly three to twelve months. The readiness work is the same either way; what changes is how long you have to run the evidence programme cleanly before fieldwork.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Criteria selection rationale and system description draft
Control mapping and gap register against every selected criterion
Evidence collection calendar with owners and frequencies
Implementation plan sequenced ahead of the observation window
Readiness scorecard by Trust Services Criterion
WHAT WE NEED FROM YOU
Executive sponsor and a named control owner per criterion
Access to existing policies, tickets and system configuration
Your chosen attestation firm, or the intention to select one
The observation window you are working toward
FRAMEWORKS THIS EVIDENCES
AICPA Trust Services CriteriaCOSO Internal Control frameworkISO/IEC 27001:2022 Annex A
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.