Decide what the report covers
Systems, Trust Services Criteria and report type, agreed against your customers’ requirements and sales timeline.
// SOC 2 · AICPA TRUST SERVICES CRITERIAGet your first
Get your first
SOC 2 report without the scramble.
For SaaS and service companies whose customers ask for a SOC 2 report: we help you choose the right criteria, put the controls in place, collect evidence through the observation period and arrive at your CPA firm's examination ready.
Type I and Type IISecurity plus optional criteriaObservation-period evidenceCPA-firm ready
5Trust Services Categories (Security always in scope)
2Report types: Type I (design) and Type II (operation)
61SOC 2 controls tracked in the Bitkosh Readiness Platform
// HOW SOC 2 IS DIFFERENT
An attestation report, not a certificate.
SOC 2 is an examination performed by an independent CPA firm against the AICPA Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are added only if your customers need them. A Type I report looks at whether controls are designed properly at a point in time. A Type II report tests whether they actually operated over a period, so the evidence has to exist before the auditor arrives. That is the part we help you get right.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Find the gaps
A readiness assessment against each in-scope criterion, with a remediation plan ranked by audit impact.
Close them with your team
Controls implemented in your tools, policies written, and evidence collection set up before the observation period starts.
Support through fieldwork
Pre-audit review, walkthrough preparation and evidence requests handled with you while the CPA firm performs its examination.
// PROJECT OUTPUTS
What your team can take into the next review.
- Scoping memo: systems, criteria and report type
- Readiness gap report with a ranked remediation plan
- Policy set mapped to the Trust Services Criteria
- Evidence calendar for the Type II observation period
- Draft system description and audit-day checklist
// BUILT FOR
Designed around the people who own the outcome.
- SaaS founders blocked by a customer security review
- Engineering leaders who will own the controls
- Sales teams answering security questionnaires
- Companies already ISO 27001 certified adding SOC 2
Scoping the report
Which systems, which criteria and Type I or Type II first. We scope against what your customers actually ask for, so you do not pay to test criteria nobody reads.
Readiness assessment
Every relevant criterion compared with how you work today: access reviews, change management, vendor management, incident response, backups and monitoring.
Control implementation
Fixes made with your engineers, not just written up: access workflows, change approvals, logging, on-call and vendor reviews, built into the tools you already use.
Observation-period evidence
For Type II, a schedule of what to collect, when and by whom, so every sample the auditor asks for already exists. Missing evidence is the most common reason for exceptions.
System description
Help drafting the description of your system that sits at the front of the report: services, infrastructure, people, data flows and complementary user-entity controls.
CPA-firm coordination
Help shortlisting CPA firms, preparing for walkthroughs and answering evidence requests during fieldwork, so your engineers are not pulled off product work for weeks.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
Readiness assessment
Talk to us
Scoping plus a gap report and remediation plan you can run yourself.
Full readiness programme
Talk to us
Scoping to fieldwork support. The examination and report are issued by an independent licensed CPA firm, billed separately.
SOC 2 readiness depends on how many systems and criteria are in scope and whether you start with Type I or go straight to Type II. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Do you issue the SOC 2 report?
No. Only a licensed CPA firm can perform the SOC 2 examination and issue the report. We prepare you for it and support you during fieldwork. Keeping readiness work separate from the examination also protects the auditor’s independence.
Should we start with Type I or Type II?
Type I is faster and shows the controls are designed properly, which can unblock a deal. Most customers eventually ask for Type II, which shows the controls operated over a period. We usually recommend the route that gets you to Type II soonest without risking exceptions.
Which Trust Services Criteria do we need?
Security is always included. Add availability if customers depend on your uptime, confidentiality if you hold their confidential data, and privacy or processing integrity only when contracts require them. Every extra criterion adds controls and testing.
We are an Indian company. Do we need SOC 2?
If you sell to North American enterprises, SOC 2 is usually what their security teams ask for, and ISO 27001 alone may not be accepted. We can run both programmes together so most evidence serves both.
How long is the Type II observation period?
The period is agreed with your CPA firm and is commonly between three and twelve months. Evidence has to be collected throughout it, which is why we set up collection before the period starts.
Let's build together
Turn the customer’s security review into a closed deal.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.