We audit your existing controls, map your infrastructure, and classify every gap by severity — before a single policy is written or a single control is built. You receive a comprehensive gap report and a prioritised remediation roadmap within two weeks of kick-off.
100+
Companies guided to certification
98%
First-attempt audit pass rate
10–12
Weeks average to audit-ready
0
Handoffs — one advisor throughout
The Five Phases
Every engagement follows the same structure. The copy changes. The commitment doesn't.
Click any phase to see exactly what happens, who does what, and what you receive at the end. Every item below has been refined across 100+ certifications.
We build the controls, write the policies, and build the evidence collection workflows — alongside your team, not instead of them. We work around your sprint cycles and never require your engineers to stop shipping product to manage a compliance programme.
Before your auditor arrives, we run the same tests they will run. Every control tested for both design adequacy and operating effectiveness. Every gap found here is closed before fieldwork begins. This is why 98% of our clients pass on the first attempt.
We manage the audit so you do not have to. Every auditor request goes through us — we triage it, review the evidence before it is submitted, and make sure your team is never blindsided by a question no one prepared them for. You focus on the business.
SOC 2 certification is not a one-time event. Enterprise buyers expect a new report every 12 months. We stay engaged through every annual renewal cycle — monitoring controls, updating evidence, and ensuring you are never scrambling in the weeks before your next audit date.
Timeline View
How the weeks map out across a full SOC 2 programme.
Type 1 certification typically issues at week 12–14. Type 2 observation begins simultaneously and concludes at month 9–12.
01 Gap Assessment
02 Implementation
03 Readiness Testing
04 Audit Fieldwork
Report Issued
05 Type 2 Observation
Why It Works
The same process. Every client. That is the point.
98% first-pass rate is not a coincidence. It is what happens when the same structured programme — refined across 100+ engagements — is applied by the same senior advisors, every time, without shortcuts.
One senior advisor throughout
The advisor who scopes your programme is the one who answers your auditor's questions on the last day of fieldwork. No handoffs. No junior running your engagement while a partner collects the fee. The same experienced practitioner, every step.
We close before we confirm
We do not issue readiness confirmation with open items. We do not start the audit clock until every gap from the readiness assessment is closed. This is not caution — it is the only reason our pass rate is 98% rather than something lower.
Fixed fee. Complete scope. No surprises.
Your total investment is agreed before we start. The gap assessment, implementation support, readiness testing, and audit management are all included. There is no billable hour that increases when you need us most — at 11pm the night before a report deadline.
We have done this. As operators.
Every advisor on our team built compliance programmes in-house before advising on them. We know what it is like to defend a control to an auditor with a two-person engineering team. The programme we built for you is the one we would have wanted when we were on the inside.
Annual renewal is built in
Most firms deliver the report and disappear. We built Phase 5 into our programme specifically because SOC 2 is not a one-time event. Your enterprise customers expect a fresh report every year. We are already managing that for you before the first one is issued.
3–6 hours from your engineering team
We are managing your compliance programme. Your engineering team's job is to answer our questions — not run a compliance project. 3–6 hours per week during implementation. Targeted, scheduled, never a surprise. Your roadmap stays on track.
Our five-phase programme takes 10–12 weeks from kick-off to audit-ready — meaning your formal audit can begin at week 10 or 11. For SOC 2 Type 1, your certified report is typically issued 12–16 weeks from engagement start. For Type 2, you begin the 6–12 month observation period simultaneously with your Type 1 programme and receive your Type 2 report roughly 9–12 months from kick-off.
A senior advisor is assigned to your engagement from day one and stays through every phase — gap assessment, implementation, readiness testing, audit support, and annual renewal. There are no handoffs to junior staff and no change of personnel between your first conversation and your certified report. The person who scopes your programme is the one who answers your auditor's questions on the last day of fieldwork.
Most clients find SOC 2 requires 3–6 hours per week from their engineering team during the active implementation phase (weeks 3–8). The gap assessment and readiness phases require less — primarily structured interviews and evidence review sessions we schedule around your sprint cycles. We deliberately minimise engineering burden so your team can stay focused on your product. The compliance work is our job. We ask your team questions. We do not ask them to run a compliance programme.
After your report is issued, we move into Phase 5 — ongoing monitoring and annual renewal. We maintain your controls, monitor for changes that affect your SOC 2 scope, and contact you three months before your next audit window to begin the renewal cycle. SOC 2 Type 2 requires a new report every 12 months. We manage the entire renewal process so you are never scrambling in the weeks before your next audit date.
Get Started
Ready to start your
compliance programme?
Book a free 30-minute consultation. A senior advisor will review your situation, confirm the right scope for your business, and give you a realistic timeline and cost estimate — before you commit to anything.
Response within one business day
You speak directly with a senior advisor
Fixed-fee engagements — agreed before work begins
// Book your free consultation