Scope & category decision
System boundary and categories, with the reasoning.
Trust services assurance
SOC 2 that answers the security review before it is sent.
The right criteria in scope, controls that fit how your engineers already work, and evidence your auditor can test without weeks of back-and-forth.
- AICPA Trust Services Criteria
- AT-C 205
- Type 1 → Type 2
- Who it is for
- SaaS, cloud, data and AI companies selling to enterprise buyers
- Report readers
- Customers’ security, risk and procurement teams
- Our role
- Scoping, readiness, control design, evidence and audit management
- The outcome
- A clean Type 2 report that shortens every security review
The business challenge
The deal is waiting on a report.
SOC 2 usually arrives as a sales problem: a prospect will not sign without one. The urgency tempts companies to copy a template written for someone else’s architecture.
We start from your buyers’ questions and your production reality. Then we design the leanest control set that meets the criteria and survives testing.
- Trust Services Categories, with Security always required
- 5 categories
- Common criteria series, CC1 to CC9
- 9 series
- Typical Type 2 observation period, agreed with your auditor
- 3–12 months
Client outcomes
What good readiness delivers.
01
Deliberate scope
Categories and boundaries that match what customers actually ask.
02
Controls engineers accept
Built into SSO, pull requests and infrastructure as code.
03
Evidence by default
Recurring controls produce their own tickets, logs and exports.
04
Reuse beyond SOC 2
One control set ready for ISO/IEC 27001 and questionnaires.
Interactive explorer
Build your Trust Services scope.
Security (CC1–CC9) is always in scope. Add categories to see how the criteria and the evidence burden grow.
Include a category only when customers rely on it contractually.
Follows the AICPA 2017 Trust Services Criteria (revised points of focus, 2022). Summaries are ours; the AICPA text governs.
Type 1 vs Type 2
Two reports, two questions.
Type 1: is the design right on one date? Type 2: did controls operate across a period? Buyers ultimately want Type 2.
Our methodology
Readiness built on production reality.
We test your environment the way your auditor will, so the examination confirms what we already know.
- Discover
Map the system
Infrastructure, data flows, vendors and customer commitments.
- Assess
Criteria gaps
Inspect live configurations, not questionnaire answers.
- Remediate
Design controls
Control set, policies, runbooks and evidence capture.
- Validate
Mock audit
Sample-test, finalize the description, brief the CPA firm.
- Sustain
Operate the period
Evidence calendar and monthly control health checks.
Your first Type 2 should record normal operations, not a quarter of heroics.
Deliverables
What you keep.
Criteria-level readiness report
Controls, gaps, evidence status and remediation per criterion.
Control matrix
Controls mapped to criteria, owners, tooling and evidence.
Policy & procedure set
Concise policies your teams will actually follow.
System description draft
Infrastructure, people, data, CUECs and subservice organizations.
Evidence calendar & auditor pack
Recurring evidence schedule and a ready request-list response.
Accreditation & scope
From readiness to a signed report
What MarkTillson delivers
- SOC 2 scoping, readiness and gap remediation
- Control, policy and technical implementation guidance
- Evidence preparation, mock audit and description drafting
- CPA firm selection and management of fieldwork
What completes the report
- The SOC 2 examination and opinion, signed by the licensed CPA firm you appoint (AT-C 205)
- International equivalents such as ISAE 3000 reports, issued by qualified assurance practitioners
Framework mapping
How SOC 2 controls carry over.
One unified control set cuts duplicated effort. Each framework still receives the evidence it asks for.
| Control area | SOC 2 | ISO/IEC 27001 | PCI DSS | ISO/IEC 42001 | HITRUST CSF |
|---|---|---|---|---|---|
| Access control & reviews (CC6) | Directly addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed |
| Change management (CC8) | Directly addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed |
| Risk assessment (CC3) | Directly addressed | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
| Monitoring & incident response (CC7) | Directly addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed |
| Vendor management (CC9) | Directly addressed | Directly addressed | Directly addressed | Partially addressed | Directly addressed |
| AI system impact assessment | Not addressed– | Not addressed– | Not addressed– | Directly addressed | Partially addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. Mappings guide planning. Each framework’s own text is authoritative.
Industry considerations
What different buyers read for.
Procurement reads the description, exceptions and CUECs, then probes tenant isolation, data deletion and staff admin access.
Buyers ask how customer data trains models and how model providers are governed. SOC 2 evidences the security controls; ISO/IEC 42001 addresses AI governance.
Banking partners often want SOC 2 alongside PCI DSS. Processing Integrity may matter where you calculate balances, fees or scores.
Health systems may accept SOC 2 with HIPAA-related assurance, or ask for HITRUST. Decide early and plan the evidence once.
Technical risks
Where readiness stumbles.
Accounts outside SSO
Local console and database accounts missing from access reviews.
Direct pushes to production
Admin bypass on branch protection undermines change evidence.
Alerts nobody owns
Detections routed to a channel with no on-call response.
Unreviewed subprocessors
Model and API providers without a documented assurance review.
Engagement journey
From kick-off to your first Type 2.
-
01
Scope
Categories, boundary and timeline.
OutputScope memo
-
02
Readiness
Criteria-level assessment.
OutputReadiness roadmap
-
03
Build
Controls and evidence capture.
OutputControl matrix & policies
-
04
Type 1 / mock
Design confirmed; auditor engaged.
OutputType 1 or mock results
-
05
Type 2
Normal operations, then fieldwork.
OutputSigned Type 2 report
FAQ
What founders and CISOs ask.
Is SOC 2 a certification?
No. It is an attestation report: a licensed CPA firm’s opinion on your controls. We prepare you for it and stay with you through fieldwork.
Which categories should we include?
Security is required. Add Availability, Confidentiality, Processing Integrity or Privacy only when customers rely on them.
How long until a Type 2 report?
Readiness, then an observation period of commonly three to twelve months, then fieldwork. We commit to a firm date once the readiness assessment is complete.
Do automation platforms replace readiness?
They collect evidence. They do not set scope, design controls for your architecture or fix gaps. We work with any platform, or none.
What is a bridge letter?
A management letter covering the gap since your last report period. Customers accept it for short gaps; it is not audit evidence.
Related
Related services and insights.
Speak with an expert
Turn the security review into a formality.
Share your architecture, your buyers’ requirements and your target date. We will map the fastest credible route to a clean report.