SERVICE ORGANIZATION CONTROL 201 / 05
attestation report
SOC 2
SCOPE1-2 DAYS
EVIDENCE2-4 WEEKS
FIELDWORK2-3 WEEKS
FINDINGS1 WEEK
LICENSED
CPA
FIRM
CPA
FIRM
SOC 2 / SERVICE ORGANIZATION CONTROL 2
Surety,
issued.
Your deal is stuck behind a security questionnaire. We're the auditor. Here's what it costs, how long it takes, and whether you should bother yet — before you talk to anyone.
We audit. That's the whole business.SOC 2 · ISO 27001 · ISO 42001 · NIST AI RMF · PCI DSS
Verifiable and
unglamorous.
unglamorous.
CPA FIRM
Jurisdiction: United StatesAICPA Peer Review: Pass
ISSUING BODY
SIS Certifications Pvt. Ltd.Accredited Certification Body
ACCREDITATIONS
IAS-CB-129UAF 51901221013
FRAMEWORKS
SOC 2, ISO 27001, ISO 42001,NIST AI RMF, PCI DSS
WHY SOC 2
Who needs
this?
B2B software companies selling into the US market. Enterprise procurement overwhelmingly defaults to requesting a SOC 2 Type II.
01 / THE DELIVERABLE
Signed by a licensed CPA firm.
SOC 2 produces a report signed by a licensed CPA firm.
02 / OUR ENGAGEMENT
We perform the independent audit.
We perform the independent audit and issue the report or certificate. We explicitly do not design controls, write policies, or provide remediation consulting.
03 / BEFORE STARTING
Policies written, systems configured, controls operational.
You must have policies written, systems configured, and controls operational. If you are not there yet, you need a readiness consultant.
THE TRUST SERVICES CRITERIA
Security is always
required.
Availability, Processing Integrity, Confidentiality, and Privacy can be added based on your business model and customer commitments.
Security
Protection against unauthorized access, disclosure, or damage.
Availability
Systems and information available as required for operations.
Processing Integrity
Processing that is complete, valid, accurate, timely, and authorized.
Confidentiality
Protection of information designated as confidential.
Privacy
Responsible collection, use, retention, disclosure, and disposal of personal information.
THE PROCESS
A predictable sequence
from scoping to certification.
Named auditor. Published response time. Shared queue you can see.
Scope Call & Proposal
A 30-minute technical call to map your environment, headcount, and framework requirements. We issue a binding fixed-fee proposal and engagement letter within one business day.
Evidence Collection & Engagement Letter
We provide an exact request list scoped to your company size. You upload policies, configurations, and population lists to our secure portal. The clock for fieldwork does not start until the evidence is complete. At this stage, we can issue an Engagement Confirmation Letter.
Fieldwork & Testing
Our auditors test the provided evidence against the framework controls. We may request specific samples from population lists. You get a shared queue to answer auditor queries. We commit to a published 1-business-day response time on all tickets so we never hold up your fieldwork.
Draft Findings
We provide a draft report or list of nonconformities. You have the opportunity to review for factual accuracy and provide management responses to any exceptions found.
Decision & Delivery
An independent technical reviewer examines the audit file. Once approved, the final attestation report or certificate is issued and your verified trust profile goes live.
HOW TO VERIFY ANY AUDITOR
A certificate is only as valuable as the body that issued it.
QUESTIONS
Key
details.
A founder shouldn't have to sit through a sales call to find out whether they can afford to sell into enterprise. Rates are on the pricing page. Nobody will call you unless you ask.
Type I evaluates the design of controls at a specific point in time. Type II evaluates the operating effectiveness of controls over an observation window (3 months typical for a first Type II, 12 months thereafter).
4-8 weeks depending on Type I vs Type II and organization complexity.
Starts at $9,000 for Type I, $12,000 for Type II. Includes Security criterion. Additional Trust Services Criteria (Availability, Confidentiality, etc.) add $1,500 each. Adding a Trust Services Criterion later mid-flight can add three to six months and $10K–$20K. Scope accurately upfront.
The quoted price does not change unless you request a scope change in writing. No overruns, no surprise hourly billing for extra evidence review.
Many competitors hide this reality: no legitimate auditor can promise a "clean" opinion before testing begins. If we find a problem, we report it. Sophisticated procurement teams read the exceptions, not just the opinion.
A single control failed, but the overall criteria was still met. The report is issued with the exception noted, and you provide a management response explaining the remediation.
A total failure to meet a requirement. Certification is withheld until the major nonconformity is demonstrably fixed and re-audited.
What it states: that an engagement exists, the exact scope of the audit, the frameworks in progress, and the date the observation window opened. What it never states: any opinion on your controls, any prediction of the final outcome, or any implication of certification. Only an auditor can attest to its own engagement. No software platform can issue this.
We audit. That is the whole business. We do not operate a consulting arm, we do not sell readiness services, and we do not accept referral fees in either direction.
REQUEST A FIXED-FEE QUOTE
SOC / 02
Get an exact
figure.
Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.
Request a quote ↗