SOC 2 readiness for a first audit.
SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards. It describes your system and gives the auditor’s opinion on whether your controls meet the Trust Services Criteria you chose. For a SaaS or AI company, it is usually the document that gets a customer’s security review signed off.
Our primary practice.
We prepare you for the audit, and a CPA firm you choose performs it. Before the auditor arrives, we assess what is in place, configure the controls that are missing, and collect evidence that covers every system in scope.
Once you have a SOC 2 report, CSA STAR Level 2 adds the Cloud Controls Matrix to your next SOC 2 audit. See how the engagements work or starting prices.
One report checks design. The other checks operation.
Many companies start with a Type 1 to unblock a deal, then move straight into a Type 2 observation period. If the controls are built to run on a schedule from the start, the Type 2 period can begin as soon as the Type 1 is done.
What customer security teams now ask.
In 2026 the AICPA told peer reviewers to watch for templated reports and unrealistic timelines. Buyers have become more careful, so expect questions like these.
SOC 2 questions.
Do we need a compliance platform?
Which Trust Services Categories should we include?
Who chooses the audit firm?
Customer asking for SOC 2?
On a scoping call we’ll tell you which report you need, what it will cover, and when you can realistically have it.