SOC 2 Type I and Type II: architected, not checkbox-automated.
For commercial SaaS and service providers proving security posture to enterprise buyers, without handing the outcome to a dashboard.
- — An enterprise deal is gated on a SOC 2 report you do not have yet.
- — You bought a compliance platform and discovered it does not implement anything for you.
- — You need Type II but nobody has designed the controls that the observation window will test.
- — You also need ISO 27001 and do not want to run the same work twice.
Type I and Type II Attestation
SOC 2 is attested against the AICPA Trust Services Criteria: Security (required), Availability, Confidentiality, Processing Integrity, and Privacy. The scope is chosen based on what your enterprise customers actually require. Most companies start with Security and Confidentiality.
Type I covers the design of controls at a point in time, useful to signal commitment and unblock a deal. Type II covers operating effectiveness over a period, usually six to twelve months, and is what enterprise customers actually want to see. Most clients sequence Type I first, then roll straight into the Type II observation window.
Compliance platforms handle evidence collection and auditor workflow well; they do not handle control design, architecture decisions, or gap remediation. We design the control framework, author the policy library, implement the technical controls, produce evidence for the observation period, manage the CPA firm relationship, and deliver a clean report, using platform tooling alongside the engagement where it genuinely helps.
- ✓ Scope selection across the Trust Services Criteria based on what your buyers demand
- ✓ Control framework design and full policy library authoring
- ✓ Technical control implementation and hardening
- ✓ Evidence pipeline for the Type II observation window
- ✓ CPA firm selection and management through fieldwork
- ✓ Shared control mapping if ISO 27001 or FedRAMP is also in scope
All engagements are anonymized. We do not publish client names.
Start with a scoping conversation.
No obligation and no pitch deck. We will tell you what the engagement actually involves, what it depends on, and whether we are the right firm for it — including when we are not.