Gap assessment, control design, policy writing, evidence preparation and audit support for SaaS companies, IT service providers and outsourcing firms that need a SOC 2 Type I or Type II report.
Book a consultation partners@agacas.comWhat is SOC 2 and how do you get a SOC 2 report?
SOC 2 is an AICPA attestation that tests a service organisation's controls against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. To get a report you scope the system, close control gaps, collect evidence and then undergo an examination by a licensed CPA firm (Type I at a point in time, Type II over a period). A. George & Associates handles the readiness work and audit coordination.
- Framework
- AICPA Trust Services Criteria
- Report types
- Type I and Type II
- Readiness time
- Typically 2–4 months
- Report issued by
- Licensed CPA firm
US and global customers increasingly ask vendors for a SOC 2 report before they sign. SOC 2 is an AICPA framework that tests your controls against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy.
A. George & Associates brings audit discipline to the readiness work. We find the gaps, help you design and document controls that actually match how your team works, and prepare the evidence so the formal audit goes smoothly.
The SOC 2 report itself must be issued by a licensed CPA firm. We work alongside your chosen CPA auditor, or introduce you to one, so you have one team managing the process end to end.
What does the service include?
Scoping & gap assessment
- Choosing Trust Services Criteria and system boundaries
- Type I vs Type II decision and audit timeline
- Gap assessment against SOC 2 criteria
- Prioritised remediation plan
Policies & procedures
- Information security policy set
- Access control, change management and incident response
- Vendor management and risk assessment procedures
- Business continuity and disaster recovery plans
Control design
- Control matrix mapped to the Trust Services Criteria
- User access reviews, onboarding and offboarding controls
- Logging, monitoring and backup controls
- Mapping to ISO 27001 where you need both
Evidence & readiness testing
- Evidence collection plans and owners
- Mock audit / internal readiness testing
- Setup support for compliance platforms such as Vanta, Drata or Secureframe
Audit support
- Introduction to and coordination with a licensed CPA auditor
- Handling auditor requests and sample selections
- Management responses to exceptions
Ongoing compliance
- Quarterly control monitoring during the Type II period
- Annual risk assessment and policy review
- Internal audit of controls before each renewal
How does it work?
Scope
Define the services, systems and criteria in scope and agree whether to start with Type I or go straight to Type II.
Assess gaps
Review current practices against the criteria and deliver a remediation plan with owners and dates.
Remediate
Write policies, implement controls and start collecting evidence, with our team tracking progress.
Readiness test and audit
Run a mock audit, fix what it finds, then support you through the CPA firm's Type I or Type II examination.
Why choose A. George & Associates?
- Audit firm since 1987 — we understand how auditors test controls and what evidence they accept
- Experience with internal controls, internal audit and IT-enabled business processes
- Practical, right-sized controls for startups and mid-sized companies
- Coordination with licensed CPA firms for the final attestation
- Combined support for SOC 2, ISO 27001 and client security questionnaires
SOC 2 examinations and reports are issued only by licensed CPA firms under AICPA standards. Our services cover readiness, control design and audit support.
Frequently asked questions about SOC 2 Readiness
What is the difference between SOC 2 Type I and Type II?
Type I reports on whether your controls are suitably designed at a point in time. Type II also tests whether they operated effectively over a period, usually 3 to 12 months. Most customers ultimately want Type II.
Can you issue the SOC 2 report?
No. A SOC 2 report must be issued by a licensed CPA firm. We prepare you for the audit and coordinate with the CPA firm you choose, or introduce you to one.
How long does SOC 2 readiness take?
For a small or mid-sized company it typically takes two to four months to close gaps and be ready for a Type I audit, depending on how mature your current controls are. A Type II then needs an observation period on top.
Which Trust Services Criteria do we need?
Security is mandatory. Availability, Confidentiality, Processing Integrity and Privacy are added based on what you promise customers and what they ask for.
We are an Indian outsourcing or IT company. Is SOC 2 relevant to us?
Yes. US clients often require SOC 2 from offshore service providers that handle their data. A report can shorten sales cycles and replace many security questionnaires.
What is the difference between SOC 2 and ISO 27001?
ISO 27001 is an international certification of an information security management system, while SOC 2 is a US attestation report on specific controls. Many controls overlap, so we map one control set to both where you need them.
Start your SOC 2 readiness assessment
AGA Tower, Major Road, Vyttila, Kochi 682019 · +91 97449 22222 · partners@agacas.com
Talk to a partner