SOC 2 readiness, without the scramble.
SOC 2 is the report US enterprise buyers most often ask SaaS vendors for. Only an independent licensed CPA firm can issue it. Cognivus does the readiness work: we find the gaps, write the policies, set up the controls and evidence, and get you ready so the audit is a formality, not a fire drill.
Type I or Type II
- Type I checks that your controls are designed properly at a point in time. It is the faster first step.
- Type II checks that those controls actually operated over a period, usually three to twelve months. It is what most enterprise buyers eventually want.
The Security criteria are mandatory; the others (availability, confidentiality, processing integrity, privacy) are added only if your customers need them.
What we do
- Gap assessment against the SOC 2 Trust Services Criteria
- Policies written to match how you actually work
- Controls: access reviews, logging, onboarding and offboarding, change management and vendor management, often set up in a tool such as Vanta or Drata
- Evidence pack assembled and organised for the auditor
- Audit support: we help you choose a CPA firm and answer their questions
Where our role ends
We prepare you; we do not issue or sign the report. A firm that both builds your controls and audits them cannot be independent, which is exactly what a SOC 2 report has to be. That is why readiness and the audit are always separate.
Frequently asked questions
Can you give us a SOC 2 report or certify us?
No, and no one honest can combine the two. Only an independent licensed CPA firm issues a SOC 2 report. We get you ready for that firm, and we stay independent of it.
Do we need SOC 2 or ISO 27001?
It depends on your buyers. SOC 2 is common with US customers; ISO/IEC 27001 is requested more internationally. The risk assessment and most controls overlap, so readiness work on one carries over to the other.
How long does readiness take?
Reaching Type I readiness typically takes six to twelve weeks, depending on how much is already in place. The Type II observation period then runs for several months.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.