SOC 2 readiness assessment helps a service organisation prepare the systems, controls and required evidence for an independent examination against selected Trust Services Criteria. The service is designed for technology, SaaS and service providers that face customer assurance demands and need to prepare efficiently before engaging an independent CPA firm.
The aim is to convert regulatory and risk uncertainty into decisions you can own, fund and evidence.
Scope is fixed with you before any work starts. Depending on the objective, environment and authorised access, the engagement may cover:
Confirm customer drivers, system scope, criteria, target report type and intended timing with the future auditor where appropriate.
Connect existing controls to the relevant criteria and identify missing or weak evidence.
Review whether controls are suitably designed and whether recurring controls operate consistently.
Assign owners, improve processes and build a clean evidence trail.
Test the package before the independent CPA examination begins.
Everything we hand over speaks to both leadership and the people who will act on it. Depending on scope, they may include:
CTG confirms the decision to be supported, the evidence threshold, responsible stakeholders and the distinction between advisory work, implementation, legal interpretation and independent assurance. Findings are linked to owners, dependencies and measurable next actions.
The engagement may draw on AICPA Trust Services Criteria, AICPA SOC 2 reporting guidance, relevant complementary frameworks such as ISO/IEC 27001. Referencing a framework describes how we structure the work; it is not, in itself, a certification, accreditation or regulatory ruling.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
SOC 2 is an examination report, not a certification. CTG can perform readiness and remediation support but cannot issue the report; the independent examination must be completed by an appropriately licensed CPA firm.
Discuss SOC 2 Readiness with CTG. A short scoping session confirms the objective, boundaries, evidence, delivery model and outputs before we issue a proposal.
Scope is fixed with you before any work starts. Typical areas include system description and service boundaries, Applicable Trust Services Criteria and customer commitments, Control design, ownership and frequency, and Policies, procedures and evidence repositories. Exclusions, required access, your responsibilities and acceptance criteria are all set out in the proposal.
Deliverables depend on the agreed objective and may include SOC 2 scope and readiness memorandum, Trust Services Criteria control matrix, Gap and remediation register, and Evidence request and retention plan. Every significant finding is tied to evidence, business impact, priority and a clear owner for the next step.
CTG normally requests the policies, registers, governance records, technical evidence and previous assessments relevant to the agreed scope. The evidence request is tailored so that the customer does not collect material that will not be used.
No. CTG provides cybersecurity assessment and implementation support within the agreed scope. Formal legal interpretation, statutory assurance and accredited certification remain separate.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
These services answer related but distinct questions. Scoping identifies whether SOC 2 Readiness, ISO/IEC 27001 Implementation and Readiness, or a coordinated programme is the smallest useful approach without duplicating work.
SOC 2 is an examination report, not a certification. CTG can perform readiness and remediation support but cannot issue the report; the independent examination must be completed by an appropriately licensed CPA firm.
