Skip to main content
Contact Us

SOC 2 readiness · Europe

SOC 2 compliance, with controls your auditor can test

US customers ask for a SOC 2 report before they sign. We get your controls and evidence ready for the audit.

Book a readiness call Type 1 or Type 2?
AICPA SOC 2Trust Services Criteria

Nine common criteria, plus the categories you choose

  1. CC1Control environment
  2. CC2Communication and information
  3. CC3Risk assessment
  4. CC4Monitoring activities
  5. CC5Control activities
  6. CC6Logical and physical access
  7. CC7System operations
  8. CC8Change management
  9. CC9Risk mitigation
  10. A1Availability
  11. C1Confidentiality
Controls mapped to criteriaAudit-ready
01 · Report types

Type 1 or Type 2: what your buyers will ask for

You can start with Type 1 to unblock an open deal, then move to Type 2 for the annual report.

Type 1
Type 2
What the auditor tests
Control design on one date
Design and operating effectiveness
Period covered
A single point in time
3 to 12 months
Evidence needed
Policies and a sample of records
Records for the whole period
How buyers read it
A sign you have started
The report most enterprise buyers ask for
Choose the right report type
02 · The path

Four steps to a Type 2 report

We prepare you for each audit. A licensed CPA firm performs it and issues the report.

01

Readiness

Scope, criteria, gap assessment and the controls to fix.

02

Type 1 audit

The auditor checks your control design on one date.

03

Observation period

Your team runs the controls for 3 to 12 months and keeps the records.

04

Type 2 audit

The auditor tests samples from the whole period.

Your auditor samples monitoring records from across the Type 2 period. Our analysts in Q-SOC, our 24/7 SOC, keep those records as they watch your systems.

Plan your audit dates
03 · What auditors check

The Trust Services Criteria, grouped by what they cover

Your auditor tests each criterion against your policies and records.

CC1CC2CC3

Governance and risk

Roles, policies, training and a risk register your team keeps current

CC4CC5

Control monitoring

Scheduled control reviews and a list of open gaps

CC6

Access

Multi-factor authentication (MFA), joiner-mover-leaver process and quarterly access reviews

CC7

Detection and incidents

Logging, alerting, vulnerability scans and a tested response plan

CC8

Change management

Peer review, approval and a trail for each code and infrastructure change

CC9A1C1

Vendors, availability and data

Vendor reviews, backups, recovery tests and data handling

Security (the common criteria) is mandatory. Add Availability, Confidentiality, Processing Integrity or Privacy where your contracts promise them.

Get a gap assessment
04 · Deliverables

What Q-SEC hands over at each phase

Each phase ends with documents your team keeps and your auditor can use.

01Readiness

Scope and gap assessment

You learn what the report covers and what is missing.

  • Scoping memo. Products, systems, people and vendors in scope
  • Criteria selection. The categories you add beyond Security, with reasons
  • Gap assessment report. A rating for each criterion against your current controls
  • Remediation roadmap. Fixes in risk order, each with an owner
  • You get: a plan that starts from your customer’s deadline
02Build

Controls and documentation

Your controls run before the audit period starts.

  • Control matrix. Each control with its criterion, owner and frequency
  • Policy set. Security, access, change, incident, vendor and continuity policies
  • Risk register. Risk method, register and treatment plan
  • System description. We draft the report’s system description with you
  • Technical fixes. We set up MFA, logging, access reviews and change workflow with your engineers
  • You get: records your team creates in its daily work
03Audit

Evidence and audit support

Your team answers the auditor with evidence already filed.

  • Evidence library. Your records, filed by control
  • Evidence calendar. The owner and due date for each record in the observation period
  • Readiness review. We test samples the way your auditor will and report what fails
  • Auditor shortlist. We help you compare CPA firms and their quotes
  • Audit support. We answer the auditor’s request list with you and help with exceptions
  • You get: a team that knows where each record sits

Need a penetration test for SOC 2?

Auditors expect proof that you test your controls. We scope our SOC 2 penetration test to your system description.

See SOC 2 penetration testing
05 · Questions

SOC 2 FAQ

Talk to a SOC 2 consultant
Is SOC 2 a certification?
No. SOC 2 is an attestation report: a licensed CPA firm audits your controls against the AICPA Trust Services Criteria and gives you a report to share with customers under NDA. The report holds the auditor’s opinion and any exceptions they found.
What is the difference between SOC 2 Type 1 and Type 2?
In a Type 1 audit, the auditor checks your control design on a single date. In a Type 2 audit, the auditor tests whether your controls worked over a period of 3 to 12 months. Most enterprise buyers ask for Type 2.
How long does SOC 2 compliance take?
The timeline depends on your scope and your current controls. A Type 2 audit also needs an observation period of 3 to 12 months. After the gap assessment we give you a plan that starts from the date your customers need the report.
Who can perform a SOC 2 audit?
Only a licensed CPA firm can issue a SOC 2 report. Q-SEC does not issue reports. We prepare your controls and evidence, help you shortlist auditors and support your team through the audit.
What do we get from a SOC 2 readiness project?
A scoping memo, gap assessment report and remediation roadmap; a control matrix, policy set, risk register and draft system description; then an evidence library, evidence calendar and a readiness review before your auditor starts. We also set up the technical controls with your engineers and support you through the audit.
Which Trust Services Criteria do we need?
Security (the common criteria) is mandatory. Add Availability, Confidentiality, Processing Integrity or Privacy where your contracts or service levels promise them to customers.
Does SOC 2 require penetration testing?
Auditors expect proof that you test your controls, and a penetration test report gives them that proof. The criteria do not require one by name. See SOC 2 penetration testing.
Is SOC 2 relevant for European companies?
No EU law requires SOC 2. US customers and many global enterprises ask for it in security reviews. SOC 2 and ISO 27001 cover much of the same ground, so one set of controls and evidence can serve both.
Readiness call

Find out what stands between you and a SOC 2 report

Bring the customer request and its deadline.

“Q-Sec helped us move from patching issues to running a proper security programme. They tightened our data protection, built a compliance path for DORA and GDPR, and trained our team to think like security professionals.”
Oleksandr PankovOleksandr PankovCEO, Miloan Polska
Teams we work with
MiloanColobridgeFinXFlypayYuria-PharmCashpointFinmeAmigo
Book a SOC 2 readiness call

We reply within 1 business day.

Pixel icons by Streamline, CC BY 4.0.