SOC 2
The audit that opens enterprise doors, done without the theatre.
Sydney headquartered CPA firm serving Australian and US companies
The baseline of enterprise information security expectations.
SOC 2 is an independent attestation, issued by a licensed CPA firm, against the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the others are added when they're relevant to what you sell. It comes in two flavours: a Type 1 that assesses the design of your controls at a point in time, and a Type 2 that tests how they operated over a period (typically 3 to 12 months).
When enterprise deals are stalling on a security review, when your customers handle sensitive data on your platform, or when the security questionnaire has stopped being something a founder can answer in an afternoon. Most companies start with a Type 1 to unblock a deal, then move to an annual Type 2 as the reporting standard their customers expect.
SOC 2, adapted to your business
We start by understanding what you actually do, not what a checklist says you should. From there we assess your existing controls against the Trust Services Criteria, share clear feedback on where they fit and where they don't, and time the audit window so the report lands when you need it.
SOC 2 audits for AI-native companiesQuestions we're often asked.
- Why are we being asked for SOC 2?
- When you collect, process, store, or even just have potential access to sensitive data, your customers need to know you have the expected security practices to protect their data. That may extend to the availability, confidentiality, privacy and processing integrity that protects that data in different ways, depending on the nature of your service.
- Type 1 or Type 2 first?
- A Type 1 is faster and usually enough to unblock a first enterprise deal. A Type 2 covers a defined period of operation and is what most customers expect year-on-year. Many companies do a Type 1 to open the door, then transition straight into their first Type 2 window.
- How long does the audit take?
- Readiness varies with where you're starting from, typically a few weeks to a few months. The Type 1 point-in-time report follows soon after. A Type 2 requires a review period of 3 to 12 months, with the report issued shortly after that period closes.
- Do we need a compliance platform?
- Only if it fits how you already work. A platform speeds up evidence collection, but the controls, decisions and evidence still need to reflect your real environment. We're platform-agnostic and work alongside whatever you've chosen.
- Which Trust Services Criteria should we include?
- Security is mandatory. Availability, Confidentiality, Processing Integrity and Privacy are added when they're material to what you're selling or how your customers use you. We help you scope this deliberately, not defensively.
- Can we combine SOC 2 with other frameworks?
- Yes. SOC 2 is very flexible and commonly coupled with HIPAA, GDPR, SOC 1 and other frameworks, in the same report or separately. It also has a high degree of overlap with ISO 27001, so it's easy to combine and gain efficiencies by covering multiple standards together.
How an engagement actually runs.
- 01. ScopingBoundary, systems, criteria. One conversation, not three weeks.
- 02. Readiness reviewGap assessment against your real environment, with practical feedback.
- 03. Pre-audit assessmentA full automated analysis of your controls for feedback pre-audit.
- 04. Audit windowAn iterative, fast-feedback cycle between our audit experts and your team to verify your compliance.
- 05. ReportA defensible, customer-ready SOC 2 report.
More SOC 2 planning and assurance guides
- SOC 2 Trust Services Criteria Explained: What They Cover and Which to Include
- SOC 2 Observation Periods and Deadlines: How to Time Your Type 2 Report
- How Much Does SOC 2 Cost? The True All-In Cost, Category by Category
- How to Check a SOC 2 Auditor's Credentials: The Questions That Actually Matter
- Choosing a SOC 2 Auditor: Why the Person Leading Your Audit Matters Most
- How CTOs Choose the Right SOC 2 Audit Firm: 5 Factors That Matter More Than Price
- How Australian Companies Should Choose a SOC 2 Audit Firm
- What makes a SOC 2 audit high quality
- Nobody wants SOC 2. They want trust.
- Five things that make compliance audits (more) enjoyable
- Do I still need a compliance platform?
- SOC 2 vs. ISO 27001: Which one is best for you, especially if you are AI-native?
- Getting Through Enterprise Security Reviews
- The Signals That Matter: Real Quality in Assurance and Security
Ready when you are
Let's discuss your SOC 2 needs.
A named senior practitioner will lead the conversation and stay accountable from scoping through report issuance.