SOC 2 Type II Readiness for an HR Platform
A clean Type II report on the first audit window, and enterprise deals unblocked the same quarter.
Client name withheld by agreement- Client
- HR and payroll SaaS
- Region
- Austin, Texas
- Year
- 2024
- Duration
- 14 weeks
- Scope
- 82 controls · AWS and Google Workspace
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
An HR and payroll platform kept losing enterprise deals at the security review stage. Buyers wanted a SOC 2 Type II report, and the company had policies on paper but no controls running consistently.
The sales pipeline could not wait a year. The company needed controls that would genuinely operate, fast, without hiring a compliance department.
What we did
The approach, step by step.
- 01
Scope that matches the product
We drew the system boundary around what customers actually buy, and selected the trust services criteria that buyers were asking about.
- 02
Controls engineered into tooling
Access reviews, change management, logging and vendor reviews were automated in AWS, GitHub and Google Workspace rather than added as manual tasks.
- 03
A dry run before the real thing
A full mock audit tested design and operation, and every exception was fixed before the observation window opened.
- 04
Auditor coordination
We prepared evidence, briefed control owners and sat beside the team through fieldwork with the independent CPA firm.
Outcomes
What changed, in numbers.
- 14
- weeks from kickoff to observation window
- 82
- controls designed and operating
- 0
- exceptions in the Type II report
- 1
- quarter until stalled deals closed
Security reviews used to end deals. Now we send the report and move to contract.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
U.S. and EU · 20 weeks
AI, Cloud & Digital Trust · 2025 · OngoingAI Governance and Red Teaming for a GenAI PlatformAn AI management system built for certification, and 31 jailbreak paths closed before launch.
-
Texas and Oklahoma · 26 weeks
AI, Cloud & Digital Trust · 2024Secure Cloud Landing Zone for a Health NetworkGuardrails in code across every account, with critical misconfigurations down 92% in two quarters.
-
North Texas · 16 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Readiness for a Defense SupplierAn SPRS score raised from 38 to 110 and a C3PAO assessment booked with confidence.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.