SOC / 02
PROCESS

The Process

A predictable sequence from scoping to certification. Named auditor. Published response time. Shared queue you can see.

FROM SCOPING TO CERTIFICATION
1 / 1-2 days

Scope Call & Proposal

A 30-minute technical call to map your environment, headcount, and framework requirements. We issue a binding fixed-fee proposal and engagement letter within one business day.

Responsibility: Usurity
2 / 2-4 weeks

Evidence Collection & Engagement Letter

We provide an exact request list scoped to your company size. You upload policies, configurations, and population lists to our secure portal. The clock for fieldwork does not start until the evidence is complete. At this stage, we can issue an Engagement Confirmation Letter.

Responsibility: Client
3 / 2-3 weeks

Fieldwork & Testing

Our auditors test the provided evidence against the framework controls. We may request specific samples from population lists. You get a shared queue to answer auditor queries. We commit to a published 1-business-day response time on all tickets so we never hold up your fieldwork.

Responsibility: Usurity
4 / 1 week

Draft Findings

We provide a draft report or list of nonconformities. You have the opportunity to review for factual accuracy and provide management responses to any exceptions found.

Responsibility: Joint
5 / 1 week

Decision & Delivery

An independent technical reviewer examines the audit file. Once approved, the final attestation report or certificate is issued and your verified trust profile goes live.

Responsibility: Usurity
ENGAGEMENT CONFIRMATION LETTER

The Engagement Confirmation Letter

SOC 2 Type II takes months. Buyer pressure is immediate. We issue an Engagement Confirmation Letter to unblock deals while fieldwork runs.

WHAT IT STATES
  1. That an engagement exists
  2. The exact scope of the audit
  3. The frameworks in progress
  4. The date the observation window opened
WHAT IT NEVER STATES
  1. Any opinion on your controls
  2. Any prediction of the final outcome
  3. Any implication of certification

Only an auditor can attest to its own engagement. No software platform can issue this.

WHEN WE FIND PROBLEMS

If we find a problem, we report it.

FINDINGS

When we find problems

SOC 2

Exceptions (SOC 2)

A single control failed, but the overall criteria was still met. The report is issued with the exception noted, and you provide a management response explaining the remediation.

ISO

Minor Nonconformity (ISO)

A lapse in the management system that does not indicate a total breakdown. You provide a corrective action plan. Certification proceeds.

ISO / SOC 2

Major Nonconformity (ISO) / Qualified Opinion (SOC 2)

A total failure to meet a requirement. Certification is withheld until the major nonconformity is demonstrably fixed and re-audited.

REQUEST A FIXED-FEE QUOTE
SOC / 02

Get an exact
figure.

Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.

Request a quote ↗