Can you make us SOC 2 certified?

No, and neither can anyone selling you readiness. A SOC 2 report is issued by an independent CPA firm, ISO 27001 by an accredited certification body, and whether you are GDPR compliant is ultimately decided by a regulator or a court. What we sell is readiness — the gap analysis, the policies, the controls, the evidence and the support through fieldwork that gets you to the auditor's door in a state where they can sign. That distinction is legal, not semantic, and we make it on the first call rather than at the end.

What will this cost in total, beyond your fee?

There are three separate costs and it is worth seeing all of them before you start. Ours covers the readiness work. The auditor or certification body bills you directly and is engaged by you, not by us, because their independence depends on it. And a compliance automation platform such as Vanta or Drata carries its own annual subscription, bought in your name. Any proposal that hides the second and third inside the first is setting up an argument later.

How long does this really take?

The readiness work itself runs two to six months depending on how much already exists. For SOC 2 Type II there is then a separate clock — an observation window during which the auditor watches your controls actually operating. That window is a period of elapsed time, so it cannot be compressed, and it cannot start meaningfully until the controls are genuinely running, which means the honest total for a company starting from nothing is longer than the readiness engagement alone.

Our compliance platform says we are nearly there. What is left?

Usually the parts a platform cannot do for you. Those dashboards are very good at collecting technical evidence from connected systems and very poor at telling you whether your policies describe what your company actually does, whether your people follow them, and whether the evidence would survive an auditor asking a follow-up question. What is left is the human process work, and it is where audits are failed.

Which standard should we be going for?

Whichever one the deal that is stuck actually requires. Ask the customer or partner blocking you for their exact wording — SOC 2 Type I and Type II are different commitments, ISO 27001 is what European and Gulf enterprise buyers more often name, HIPAA involves a signed BAA rather than a certificate, and GDPR readiness may be satisfied by a data processing agreement plus demonstrable practices. Choosing the wrong one costs months.

Do you fill in security questionnaires as well?

Yes, and they are priced separately because each one is a real body of work rather than a form to tick. Enterprise vendor questionnaires are long, and the answers have to be consistent with your policies and with the last questionnaire you returned. Once the underlying documentation exists, answering them gets much faster, which is one of the quieter benefits of doing this properly.

Cybersecurity

Compliance readiness

Gap analysis, policies written to how you actually work, controls implemented and evidence collected — so that the audit for GDPR, SOC 2, ISO 27001 or HIPAA is survivable.

From: $3,000–$40,000
Typical time: 2–6 months
Usually bought by: B2B SaaS, health

What this actually solves

Almost nobody buys compliance readiness because they woke up caring about controls. They buy it because a deal has stopped. A large customer has asked for the SOC 2 report before signing. A European client's legal team wants a data processing agreement and evidence to back it. A healthcare buyer cannot proceed without a signed business associate agreement. The company has the capability to do the work and no way to prove it in the format the buyer's procurement process accepts.

That makes this the clearest return in the whole of security. You already know the value of the contract sitting on the other side of the door, which means the conversation is about time and sequence rather than justification. It also means the pressure is to go faster than the standard allows, and part of the job is being the person who explains that an observation window is a period of elapsed time and cannot be bought.

The second thing this solves is quieter. Growing companies accumulate access, vendors, laptops and data in places nobody has mapped. A standard forces that map to exist. You may well find the risk register and the vendor inventory more useful in running the business than the certificate you came for.

How the programme runs

Scope. Which product line, which systems, which offices, which entities — and for SOC 2, which Trust Services Criteria. Scoping too wide is the most expensive early mistake available, because everything downstream multiplies. One week.
Gap analysis. Every control in the standard taken one at a time and marked as present, partial or absent, mapped against the tools you already own, with the evidence an auditor will ask for written next to it and an owner and rough effort attached. The output is a worksheet you can act on, not a score. Two to four weeks.
Policies written to how you actually work. The set the standard expects — access control, change management, incident response, vendor management, business continuity, data retention and the rest. Each one drafted from how this company really operates and reviewed with the person who will own it, because a policy is a promise that will be tested. Four to eight weeks, overlapping the next step.
Controls implemented. Multi-factor authentication, joiner-mover-leaver process, change management with evidence, vendor review, backup with a tested restore, logging, an annual risk assessment and security training. This is where readiness stops being documentation and starts changing how work happens. Four to ten weeks.
Evidence system. Usually a compliance automation platform such as Vanta, Drata or Secureframe, bought in your name and configured to pull evidence continuously from your identity provider, cloud account, repository and HR system — so that evidence collection is a background process rather than a scramble the week before fieldwork. One to two weeks to configure, continuous thereafter.
Auditor selection and fieldwork support. Introductions, scoping conversations, evidence packaging, and being the person who answers the auditor's follow-up questions so your engineers are not doing it. For Type II this follows the observation window. Two to six weeks of active support around the audit.

What moves the price

$3,000–$40,000 over 2–6 months is a very wide range, because the starting positions are very far apart.

How much already exists. A company with a single cloud account, an identity provider, managed laptops and some documentation is a different engagement from one where access is personal Gmail accounts and the code lives on somebody's machine. The gap analysis is the same length; everything after it is not.

Company size and the number of systems. Headcount drives the human controls — training, access reviews, onboarding and offboarding evidence — and the number of distinct systems drives how many integrations, policies and evidence sources have to be maintained. Multiple entities or offices multiply both.

Whether we plan it or run it. A gap analysis and a remediation plan handed to your own team sits at the lower end of the range. Carrying the programme — writing the policies, implementing the controls, chasing the owners, packaging the evidence and standing next to you through fieldwork — is months of sustained follow-up and sits at the upper end.

What usually goes wrong

Policy templates are downloaded and the company name changed. The auditor finds this in the first meeting, and the mechanism is always the same — they read what the policy claims happens and then ask for evidence that it happened. When the document says access is reviewed quarterly and no review has ever occurred, the company has not just failed a control, it has produced a signed statement that works as evidence against itself. Policies that describe what you really do, even when what you really do is modest, pass. Aspirational ones do not.

The observation window is started before the controls are working. For SOC 2 Type II the window is a period during which the auditor observes controls operating consistently. Starting it because the calendar looked good, while onboarding evidence is still patchy and nobody has run an access review, produces a report full of exceptions — or a restarted window and several months lost. The window starts when the controls are genuinely running, and not on the date somebody hoped.

Somebody promises you the certificate. Being told on the first call that a supplier will make you SOC 2 compliant is easy to hear and indefensible by the last one, because the decision was never theirs to make — the report is issued by an independent CPA firm, the certificate by an accredited body, and compliance itself is ruled on by a regulator or a court. The promise also removes your own reason to engage, because you believe you have bought an outcome rather than joined a programme that needs your people in it. Readiness is the thing that can honestly be sold, the auditor decides the rest, and hearing that early is what keeps the relationship intact when the auditor asks a hard question.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

Can you make us SOC 2 certified?: No, and neither can anyone selling you readiness. A SOC 2 report is issued by an independent CPA firm, ISO 27001 by an accredited certification body, and whether you are GDPR compliant is ultimately decided by a regulator or a court. What we sell is readiness — the gap analysis, the policies, the controls, the evidence and the support through fieldwork that gets you to the auditor's door in a state where they can sign. That distinction is legal, not semantic, and we make it on the first call rather than at the end.
What will this cost in total, beyond your fee?: There are three separate costs and it is worth seeing all of them before you start. Ours covers the readiness work. The auditor or certification body bills you directly and is engaged by you, not by us, because their independence depends on it. And a compliance automation platform such as Vanta or Drata carries its own annual subscription, bought in your name. Any proposal that hides the second and third inside the first is setting up an argument later.
How long does this really take?: The readiness work itself runs two to six months depending on how much already exists. For SOC 2 Type II there is then a separate clock — an observation window during which the auditor watches your controls actually operating. That window is a period of elapsed time, so it cannot be compressed, and it cannot start meaningfully until the controls are genuinely running, which means the honest total for a company starting from nothing is longer than the readiness engagement alone.
Our compliance platform says we are nearly there. What is left?: Usually the parts a platform cannot do for you. Those dashboards are very good at collecting technical evidence from connected systems and very poor at telling you whether your policies describe what your company actually does, whether your people follow them, and whether the evidence would survive an auditor asking a follow-up question. What is left is the human process work, and it is where audits are failed.
Which standard should we be going for?: Whichever one the deal that is stuck actually requires. Ask the customer or partner blocking you for their exact wording — SOC 2 Type I and Type II are different commitments, ISO 27001 is what European and Gulf enterprise buyers more often name, HIPAA involves a signed BAA rather than a certificate, and GDPR readiness may be satisfied by a data processing agreement plus demonstrable practices. Choosing the wrong one costs months.
Do you fill in security questionnaires as well?: Yes, and they are priced separately because each one is a real body of work rather than a form to tick. Enterprise vendor questionnaires are long, and the answers have to be consistent with your policies and with the last questionnaire you returned. Once the underlying documentation exists, answering them gets much faster, which is one of the quieter benefits of doing this properly.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Compliance readiness All Cybersecurity services