Which Trust Service Criteria apply to us?

Most SaaS companies start with Security (common criteria). Privacy, Availability, Processing Integrity, and Confidentiality are included based on customer commitments and service scope. We help you select the right categories.

SOC 2
Type I & Type II Attestation

A complete SOC 2 programme, from readiness assessment and control design through evidence collection and CPA firm liaison, covering all five Trust Services Criteria for both Type I and Type II attestation.

Achieve SOC 2 Compliance All Compliance

TSC Gap Analysis All Five Criteria Mapped Automated Evidence Collection CPA Firm Liaison

Trust Services Pentagon

Security (CC6.1 - CC6.7)

Availability (CC7.1 - CC7.3)

Processing Integrity (CC8.1)

Confidentiality (CC6.1)

Privacy (CC9.1 - CC9.3)

SOC 2 Type II Ready

Type II

Audited

TSC Mapped

Trust Services

What We Do

Readiness to Report: A Fully Managed SOC 2 Programme

SOC 2 is audited by an independent CPA firm against AICPA Trust Services Criteria. It cannot be self-certified. Our role is to prepare you so thoroughly that the audit itself is a formality. From gap assessment through to a clean Type II SOC 2 report, we manage control design, evidence collection, auditor liaison, and ongoing compliance monitoring.

Readiness Assessment

Gap-assess controls against TSC categories; produce a prioritised remediation plan with timeline.

Scope Definition

Define SOC 2 scope, systems, and applicable TSC categories; minimise scope to reduce cost while satisfying auditor requirements.

Risk Assessment

Identify and rank risks to TSC categories within scope by likelihood and impact; guide control priorities.

Vendor and Sub-Processor Review

Assess third-party and sub-processor controls within SOC 2 scope; verify downstream compliance and evidence sufficiency.

TSC Category Selection

Advise on TSC category inclusion (Security, Availability, Processing Integrity, Confidentiality, Privacy) based on customer and market requirements.

Current Control Inventory

Catalogue existing controls and map to TSC criteria; identify overlaps and gaps requiring new controls.

Control Design and Implementation

Design and implement controls mapped to each TSC category: access, encryption, monitoring, change management, availability.

Evidence Collection

Collect and organise control evidence across the observation period; format for CPA firm review.

Policy and Procedure Documentation

Build the SOC 2 policy and procedure library: information security, access control, incident response, change management, risk management.

Continuous Monitoring Setup

Deploy automated monitoring controls (log management, alerting, access reviews) generating ongoing Type II observation evidence.

Access Control Implementation

Implement RBAC, MFA, privileged access management, and user lifecycle processes aligned to TSC Security and Confidentiality criteria.

Staff Security Training

Deliver SOC 2-aligned security awareness training covering acceptable use, incident reporting, and security hygiene.

Auditor Liaison

Liaise with your CPA firm: answer queries, supply evidence, resolve exceptions to achieve a clean attestation report.

Ongoing Compliance Monitoring

Periodically review controls, evidence sufficiency, and new TSC requirements; maintain readiness for Type II renewals.

Evidence Maintenance

Continuously collect, organise, and archive control evidence throughout the observation period; ensure audit readiness at any point.

Access Review Cadence

Implement quarterly access reviews, privileged account audits, and offboarding verification; maintain TSC compliance between audit periods.

Incident Response Readiness

Validate incident response procedures remain current and tested through tabletop exercises; document and remediate exceptions promptly.

Change Management Tracking

Maintain change management records and approval workflows; document every infrastructure and application change per TSC requirements.

Who Needs SOC 2

Is SOC 2 Right for Your Business?

SaaS and Cloud Providers

Any SaaS company selling to US enterprises, government, or regulated sectors. SOC 2 is the minimum security requirement in virtually every enterprise vendor security review.

Data Processors and Managed Services

Managed service providers, data analytics firms, and cloud infrastructure companies that store or process customer data and face vendor security questionnaires.

Growth-Stage Startups

Series A/B companies that need to unblock enterprise sales cycles. SOC 2 Type I removes the security objection and demonstrates security maturity to investors and customers.

Methodology

How We Build Your SOC 2 Programme

A structured six-phase process from initial readiness assessment through to ongoing audit readiness and Type II report renewal.

Phase 01

Readiness Assessment and Scoping

Evaluate current controls against TSC requirements, define scope, select applicable categories, and produce a prioritised remediation plan.

Phase 02

Control Design and Policy Build

Design and implement required controls with documented procedures, policy library, and automated evidence collection mechanisms.

Phase 03

Monitoring and Evidence Infrastructure

Deploy continuous monitoring controls, configure log management and alerting, and establish evidence collection workflows for the observation period.

Phase 04

Observation Period Management

Monitor controls over the Type II observation window, collecting continuous evidence and remediating any control exceptions identified during the period.

Phase 05

Audit and Report

Coordinate CPA firm audit: provide evidence packages, field auditor queries, resolve exceptions, and receive your SOC 2 attestation report.

Phase 06

Ongoing Audit Readiness

Maintain continuous compliance monitoring, evidence collection, and control validation to ensure readiness for subsequent audit periods and Type II renewals.

FAQ

Questions We Get Asked Often

SOC 2 is an attestation report that evaluates an organisation's controls relevant to the five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. It is issued by an independent CPA firm.

SOC 2 Type I evaluates control design at a point in time. SOC 2 Type II evaluates operating effectiveness over a minimum 6-month period. Type II is preferred by most enterprise customers and is increasingly required for vendor qualification.

SOC 2 Type II readiness and audit typically takes 6 to 9 months with Scyverge, including gap assessment, control implementation, evidence collection, observation period, and CPA firm audit.

Type I assesses control design at a single point in time. Type II evaluates operating effectiveness over a minimum observation period, typically 6 to 12 months. Enterprise customers overwhelmingly require Type II reports.

Type I readiness and audit typically takes 3 to 5 months. Type II requires an additional 6 to 12 months of operating evidence. Scyverge helps you choose the right type and timeline for your customer requirements.

SOC 2Type I & Type II Attestation