Remote GRC service
SOC 2 Readiness Consultant
SOC 2 readiness support: scoping Trust Services Criteria, control design, policies, evidence collection, readiness assessment and preparation for a Type 1 or Type 2 examination.
A SOC 2 report from a CPA firm is often the price of entry for selling software to larger customers. Readiness is about designing controls that fit the business and collecting evidence consistently over the observation period.
Ian helps teams prepare for SOC 2 and keeps ISO 27001 and GDPR work aligned so controls are mapped once and reused. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.
Who it is for
- SaaS and service companies asked for a SOC 2 report by customers.
- Teams choosing between a Type 1 and Type 2 report.
- Organisations with ISO 27001 that want to reuse controls for SOC 2.
What is included
- Scope and Trust Services Criteria selection.
- Readiness assessment and control gap list.
- Control matrix mapped to SOC 2, ISO 27001 and GDPR.
- Policies and procedures the auditor will request.
- Evidence calendar and collection support during the observation period.
How it works
- 1Scope. Choose systems, criteria and report type.
- 2Readiness. Assess controls and close gaps before the audit window opens.
- 3Evidence. Run controls on schedule and file evidence as it is produced.
- 4Audit support. Prepare owners for interviews and respond to auditor requests.
Frequently asked questions
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 reports on control design at a point in time. Type 2 reports on design and operating effectiveness over a period, commonly three to twelve months.
Can you do SOC 2 and ISO 27001 together?
Yes. Many controls overlap, so a single control matrix mapped to both lets one piece of evidence satisfy both audits.
Free resources
Work together
Share your role, contract or project and Ian will reply by email to discuss scope and timing.
Go to the request form