SOC 2 Readiness Services: What They Cover and What to Ask

The audit is the part everyone budgets for and the part that turns out to be simple. You hire a licensed CPA firm, it examines your controls, it issues an opinion. There is very little to shop for.

Readiness is the other nine months, and it is where the money and the confusion both sit. Three firms will send you proposals that use the same words and describe different products. One is a two-week diagnosis that ends in a spreadsheet of everything wrong. One is a nine-month program in which somebody writes your policies, argues with your engineers about logging retention and sits in the auditor's walkthrough calls. One is a software subscription with a compliance manager attached to it. All three are called SOC 2 readiness, and the gap between the first and the second is most of what you will spend.

What Are SOC 2 Readiness Services?

A SOC 2 examination is an accountant's opinion on controls at a service organization, tested against criteria covering security and, where you elect them, availability, processing integrity, confidentiality and privacy. Nothing in that description tells you how to become a company those controls can be found in. That is the job readiness services do.

The phrase covers two different purchases that share a name.

The first is an assessment. Somebody with SOC 2 experience looks at how you actually work, measures it against the criteria, and hands you a written list of the differences. It takes a few weeks, ends in a document, and leaves every gap on your desk.

The second is a program. The same measurement happens, and then the provider stays and does the work: writing policies, standing up access reviews, chasing evidence, arguing about retention, and being in the room when the auditor asks a question nobody expected. It runs for months and costs several times the assessment.

Buyers who are disappointed by readiness services are almost never disappointed by the work performed. They are disappointed because they bought the first thing while picturing the second. If you read nothing else on this page, read the include and exclude section and make your provider agree to it in writing.

The reason any of this is on your calendar is usually commercial rather than technical. Your customer's vendor risk team has stopped accepting a questionnaire, and it has stopped for a measurable reason: the 2026 Verizon Data Breach Investigations Report found that breaches involving a third party now account for 48 percent of all breaches, with third-party supply chain breaches up 60 percent. When close to half of everything that goes wrong arrives through somebody's supplier, the people buying from you stop taking your word for it. If the underlying idea is still new, what a SOC 2 report is and is not is the shorter piece to settle first.

What SOC 2 Readiness Services Include and Exclude

Nearly every provider's inclusion list is the same five items, whatever the price. The differences live in the second table.

Now the exclusions, which are the part that gets left out of proposals. Schellman, a CPA firm that performs SOC examinations, is unusually direct about them in its published description of a readiness assessment: there is no opinion letter, and the engagement does not include advisory, remediation or implementation services. Take that as the default and negotiate up from it.

No opinion, and no report you can send anyone. A readiness deliverable is an internal document. It is not evidence of compliance, it does not go to a customer, and a prospect who asks for your SOC 2 report will not accept it. Some providers write it in a format that looks like a report, which is a presentation choice and nothing more.

Not the audit. The examination is a separate engagement, a separate fee and often a separate firm.

Usually not the engineering. Someone still has to turn on multi-factor authentication everywhere, configure encryption in transit and at rest, build the offboarding checklist and wire the alerting. Advisory readiness firms will design and supervise that work. Very few will perform it, and those that do are selling a managed service with a readiness label on it.

Not evidence for a period that has not happened. No amount of preparation produces records for months you have not lived through yet. This is the single most expensive misunderstanding in the category, and it is covered in the timeline below.

Not accountability. The controls are yours, the assertion in the final report is management's, and the customer contract that made you do this was signed by you. A provider can carry the work. Nobody sells a transfer of responsibility.

Types of SOC 2 Readiness Services You Can Buy

Four shapes cover almost everything on the market. The words on the website rarely tell you which one you are looking at, so ask.

Assessment only. A fixed-fee diagnostic, typically two to six weeks, ending in a gap report and a debrief. Right for a company that already runs a real security program and wants an experienced outsider to find what it cannot see in itself. Wrong for a company starting from nothing, which will spend the fee to learn that it is starting from nothing.

Advisory readiness. A longer engagement, priced monthly or as a project, in which the provider owns the remediation plan and drives it. You get policy drafting, control design, a weekly meeting that does not get canceled, and someone who will tell your CTO that the logging retention is not negotiable. This is what most companies actually need for a first report and what most think they are buying when they buy the first option.

Platform-led readiness. A compliance automation subscription plus a named compliance manager. The software connects to your cloud accounts and identity provider, monitors control status, holds your policies and collects evidence into a room the auditor can be given access to. It removes an enormous amount of manual collection. What it cannot do is perform a control. A dashboard reporting that a quarterly access review is overdue is not a performed access review, and an auditor will ask for the review.

Bundled into a retainer. Firms that already provide a part-time security leader usually fold readiness into that relationship, which is efficient if the relationship exists and a poor reason to start one if it does not. The same is true of a broader security advisory engagement where SOC 2 is one workstream among several.

What a SOC 2 Readiness Engagement Looks Like End to End

Three parties are involved and the handoffs between them decide how long the whole thing takes. Almost nobody draws this before a buyer signs, which is why the auditor's first evidence request so often arrives as a surprise.

The phases inside that are consistent across providers, and one CPA firm publishes its durations. Schellman's project flow puts planning at two to five business days, walkthrough meetings at roughly a week, evidence collection running concurrently with the walkthroughs, and reporting at about another week. That is the assessment portion. Remediation sits outside it and is the part that stretches.

Phase 1: scoping. Which system, which environments, which entities, which trust services categories. This is a commercial decision dressed as a technical one, because everything you put inside the boundary generates evidence for every period from now on. Security alone is a complete and credible SOC 2. Add availability if you sell an uptime commitment. Leave privacy out of a first report unless a contract names it.

Phase 2: walkthroughs and control mapping. Interviews with the people who actually perform the work, not the people who wrote the policy. A good assessor talks to the engineer who approves the pull request and the office manager who handles laptop returns, and finds the gap between the two accounts.

Phase 3: evidence review. Every control is examined for whether it leaves a trace. This is where most first-time programs fail, and the failure is never the control. Access is reviewed; nobody records the review. Changes are approved in a chat thread that expires in 90 days. Vulnerability scanning runs weekly and nothing captures who looked at the output.

Phase 4: the gap report and remediation plan. Findings mapped to criteria, prioritized, with owners and dates. If your provider hands you a list with no owners on it, the list is not finished.

Phase 5: remediation. Weeks to many months. Policy work is fast. Anything requiring engineering time competes with your product roadmap and loses unless somebody senior decides otherwise. A tested incident response plan is a common long pole, because the tabletop exercise the criteria expect has to be scheduled with executives who are hard to schedule.

Phase 6: the readiness check. A short re-look confirming the fixes are real and running, immediately before the observation period opens. Some providers include it and some sell it separately. Ask.

SOC 2 Readiness Assessment vs Type 1 vs Type 2

Three documents, and only two of them can be shown to a customer. Buyers confuse the first with the second constantly, usually because a salesperson allowed it.

The sequencing question that follows is whether to buy a Type 1 at all. A Type 1 is legitimate, it can be produced within weeks of readiness work finishing, and it buys time with a customer who needs something now. It also costs a full examination fee for a document a sophisticated buyer reads as a promise that a Type 2 is coming. If your customer will accept a signed statement of when your Type 2 period ends, skip it. If the deal genuinely dies without a document, buy it and put the Type 2 date in the same email.

How SOC 2 Readiness Providers Differ From Each Other

The four provider types differ less in competence than in what their business model permits them to do for you.

Beyond the type, three things separate a good provider from an expensive one.

Whether it has seen your kind of company. The criteria are the same for a payroll processor and a machine learning platform, and the sensible control design is not. Ask for two references in your industry at your size, and call them.

Whether it will name the assessor. Firms rotate juniors through readiness work. The person on the sales call is not always the person reading your access logs, and the difference shows up in the quality of the gap list.

Whether it thinks. This one has a public and unusually candid source. In May 2026 the AICPA's Journal of Accountancy reported guidance for peer reviewers on specific risks in SOC 2 engagements, naming the risk that a firm's engagements are not designed to respond to the unique risks associated with the service organization, resulting in engagements that have identical reports, risk assessments, sample sizes and testing procedures. It also records that some firms are leaning too heavily on third-party SOC platforms without applying the professional judgment the standards require. Reviewers are told that looking at a single engagement file is often insufficient, and that where the risk appears they should select roughly five engagements from different partners and compare.

Can Your Auditor Perform Your SOC 2 Readiness Assessment?

The market's stock answer is no, and it is wrong often enough to be worth getting right, because it changes who you can hire.

The real rule is about management responsibilities rather than about readiness. Readiness work performed by a CPA firm for a company it also audits is a nonattest service, and the AICPA's general requirements for nonattest services allow it under conditions. As the Journal of Accountancy sets out in its explanation of maintaining independence with nonattest services, the CPA cannot assume management's responsibilities, and the client has to agree to assume all management responsibilities, to oversee the service by designating an individual with suitable skills, knowledge and experience, to evaluate the adequacy and the results of the work, and to accept responsibility for the results. The understanding has to be documented in writing before the service is performed.

So a CPA firm can tell you that your access review process would not satisfy CC6. It cannot decide on your behalf what the process should be, write it for you and then test it. Where it crosses into building and running things, the profession is blunt: the AICPA's revised interpretation on information systems services holds that threats to independence would not be at an acceptable level where a member designs or develops a financial information system for an attest client, and that taking on an ongoing function such as systems monitoring, support or maintenance is assuming a management responsibility.

What that means in practice, for a buyer:

• A CPA firm can perform an assessment and later examine you, with the written understanding and the designated internal overseer in place. Many do.
• The same firm cannot write your policies, configure your controls, run your access reviews and then issue an opinion on them.
• A security consultancy has no such constraint, because it is not issuing an opinion on anything. It can build the whole program. It just cannot be the one to attest to it.
• The person you designate with suitable skills, knowledge and experience is a real requirement, not paperwork. If nobody inside your company can evaluate the work, you have a bigger problem than which firm to hire.

What Do SOC 2 Readiness Services Cost?

No independent dataset publishes this. The ranges you find are self-published by companies selling the service, derived from their own book of business and not audited by anyone, so anchoring on a number you read is a way of being sold to rather than a way of budgeting. What is knowable is what moves the price, and that is enough to compare three quotes properly.

Scope, more than anything else. Every additional trust services category, product line, environment and legal entity multiplies the mapping work and then multiplies the evidence forever after. A second category added at scoping is cheap on the quote and expensive for years.

Where you are starting from. A company with an identity provider, a ticketing system and a logging platform already in place is buying a review. A company running on shared logins and a spreadsheet is buying a construction project.

Headcount and environment count. Sample sizes and walkthrough hours scale with the number of people who touch production and the number of places production lives.

Whether remediation labor is inside the fee. This is the largest single swing between proposals and the one most often left ambiguous. Get it in writing.

Whether a platform subscription is bundled. Price it separately. It is a multi-year commitment with its own renewal and its own exit problem, and folding it into a project fee hides both.

Three things make quotes comparable. Send every firm the identical scope statement, with the categories and the entity list written out. Ask each to price the assessment and the remediation support as separate line items even if you intend to buy both. And ask each what is excluded, in a list, in the proposal. The provider that answers that question clearly is usually the one that has done this often enough to know where engagements go wrong.

Questions to Ask Before You Hire a SOC 2 Readiness Firm

Nine questions, and they can go out by email before anyone books a call. Each one maps to a term in the next section.

Two answers should end the conversation. A guaranteed pass, for the reason set out above: the firm making the promise is not the firm signing the opinion. And a refusal to put the exclusion list in the proposal, which is a decision to argue about it later, when you have less leverage.

SOC 2 Readiness Contract Terms That Matter

The statement of work is where a readiness engagement either becomes useful or becomes an invoice. These are the clauses worth spending an hour on.

The deliverable, defined by content rather than by name. Not "a readiness report" but a document containing findings mapped to each applicable criterion, a severity or priority for each, a recommended remediation, a named owner and a target date. Say it in the contract so that a slide deck cannot satisfy it.

Scope, itemized. The categories elected, the products, the environments, the legal entities and the subservice organizations you rely on. Ambiguity here resolves in the provider's favor while the work is happening and in nobody's favor afterward.

Whether remediation is advisory or performed, and by whom. Three states exist: the provider advises and you build; the provider builds; the provider supervises a third party building. Name the one you bought, and name the hours.

Re-review scope and deadline. What is re-examined after remediation, whether it is the finding or the whole control, and how long you have to use it before it expires.

Artifact ownership and license. Policies and control descriptions written on your engagement should be yours outright, with no license that lapses when the relationship does. Providers who build on templates sometimes grant a license instead of ownership. That is negotiable, and it matters the day you switch providers.

Platform terms, kept separate. Subscription length, what happens to your evidence and policy library at the end of it, and whether you can export in a form another platform or an auditor can read. A compliance platform holds the history of your program. Getting it out later is a term, not an assumption.

Referral and independence disclosure. Any financial relationship with an auditor they introduce, disclosed in writing. And, where the provider is a CPA firm, the written understanding the profession requires: your acceptance of management responsibilities, your designated individual with the suitable skills, knowledge and experience to oversee the work, and the limits of what they will do.

Fee structure and overrun. Fixed fee, time and materials, or a monthly retainer with a stated hour band. Where it is hourly, agree what happens when the estimate is passed, and who authorizes the extra hours.

Staffing continuity. The named people stay on the engagement, and a substitution needs your agreement. Readiness work is contextual, and a mid-engagement swap costs you the context.

Confidentiality of the gap report itself. It is a written inventory of your security weaknesses with dates attached. Agree where it is stored, who inside the provider can read it, how long it is retained afterward, and that it is not reused as a case study. The same discipline applies to whatever you hand your auditor later, and to the centralized logging evidence that goes with it.

Do You Need SOC 2 Readiness Services?

Sometimes not. A self-assessment is a legitimate option, and the honest test for it is a single condition: does someone in your company know, from experience, what a SOC 2 auditor accepts as evidence? Not what the criteria say, which anyone can read. What a tester will accept when they ask for four quarterly access reviews and you show them a screenshot.

If that person exists, run the mapping yourself, spend the money on the controls, and buy an outside look only before the observation period opens. If that person does not exist, the readiness fee is buying their judgment, and the alternative is discovering the answer during fieldwork, when the cost of being wrong is an exception printed in the report your customer reads.

Two situations remove the choice. A contractual deadline you are already behind, where an experienced provider is buying you weeks you cannot otherwise find. And a first report in a regulated adjacency, healthcare or financial services, where your customers' own auditors will read your report closely and a thin one creates a second problem.