SOC 2 · Trust Services Criteria
SOC 2 readiness
Prepare for the SOC 2 report your customer has asked for. Aegentra defines the service boundary, assesses gaps against the relevant Trust Services Criteria and organises the controls and evidence for the examination. A licensed CPA firm performs the SOC 2 examination and issues the report; Aegentra prepares. Consultants based in Europe work remotely and on site in Germany.
What we deliver
What readiness produces
Your written scope sets the deliverables and who owns each one. Readiness is built around these outputs.
- Scope and report choice
- The service, systems, Trust Services Categories and report type (Type I or Type II) your customer actually needs.
- Gap assessment
- A comparison of current controls and evidence with the applicable criteria, with prioritised gaps and owners.
- Control-to-evidence map
- Each criterion linked to a control, an accountable owner and the records that show it operates.
- Policies and system description
- Agreed policies tailored to your environment, and support preparing the system description.
- Readiness review
- A review before the examination that identifies outstanding actions.
- CPA firm handover
- The agreed readiness outputs handed over to the CPA firm you appoint.
Context
SOC 2 is a report, not a certificate
SOC 2 is an examination of a service organisation’s system and controls against the AICPA Trust Services Criteria. A licensed CPA firm performs the examination and issues the report. A Type I report addresses the design of controls at a specified date; a Type II report also covers whether controls operated effectively over a period.
Your customer decides whether the report’s scope, period and results meet its requirements, so confirm what it expects before work starts.
SOC 2 and ISO/IEC 27001
Existing ISO/IEC 27001 records such as access reviews, risk assessments, supplier reviews and incident records may support SOC 2 preparation, once their relevance to the service boundary and reporting period has been checked. An ISO/IEC 27001 certificate does not satisfy SOC 2, and a SOC 2 report does not replace an ISO/IEC 27001 certificate.
What this service is not
Aegentra is not a CPA firm and does not perform SOC 2 examinations or issue reports. Readiness support does not guarantee a particular opinion, report date or customer decision.
How it runs
From customer request to CPA handover
Scoping call
We confirm the service your customer buys, the report type and categories it expects and your timing, then quote a fixed fee.
Define
We set the service boundary, criteria and responsibilities, including how subservice organisations are treated.
Assess
We review existing controls, policies and evidence and agree priorities and owners.
Prepare
Agreed documentation is tailored and evidence mapped; technical remediation is done by the responsible team or under a separate scope.
Review and hand over
We carry out the readiness review and hand the agreed outputs to your CPA firm, which determines its own procedures and opinion.
Who it suits
Organisations this suits
- Software and cloud service providers whose customers, often in the United States, ask for a SOC 2 report.
- Organisations that hold ISO/IEC 27001 and now receive SOC 2 requests.
- Teams preparing for a first Type I or Type II examination.
Questions
Frequently asked questions
Does Aegentra perform the SOC 2 audit?
No. A licensed CPA firm performs the SOC 2 examination and issues the report. Aegentra provides readiness and preparation and can work with the firm you appoint.
Type I or Type II?
Follow your customer’s requirement. Type I covers control design at a specified date; Type II also covers operating effectiveness over a period. A Type I report is not a mandatory first step.
Is SOC 2 a certification?
No. It is an attestation report. There is no SOC 2 certificate.
We already hold ISO/IEC 27001. Do we still need SOC 2?
If your customer asks for a SOC 2 report, yes. Existing ISMS evidence may help, but one does not replace the other.
What does it cost?
We do not publish a price. After a scoping call we quote a fixed fee for the readiness scope. CPA firm fees are separate.
A customer asked for SOC 2?
Tell us which service it buys, the report it expects and when it needs it.