Skip to content
GetComply

SOC 2 readiness

Your customer asked for SOC 2. You need someone to run the work.

Launch Readiness is our engagement for companies preparing for a first SOC 2 examination. We scope the system, design controls, draft policies, track remediation, check evidence, and coordinate with your CPA firm.

Your team makes technical changes, and management approves policies, scope, and risk decisions. An independent CPA firm performs the examination and issues the report.

Request an intro call

$4,500/month · generally planned over four to six months

What Launch Readiness covers

Included work, subject to the engagement scope:

  • Define the relevant systems, services, personnel, data, vendors, and customer commitments.
  • Review existing controls, policies, procedures, and evidence.
  • Document gaps and maintain a remediation plan with owners and target dates.
  • Draft relevant policies and procedures for approval by management.
  • Establish risk, exception, evidence, and review processes.
  • Coordinate initial critical-vendor reviews and create a starting library of security-questionnaire answers.
  • Review evidence before it is organized for the CPA firm.
  • Prepare system-description inputs and coordinate agreed examination requests.
  • Report progress and unresolved decisions throughout the engagement.

How the work is sequenced

We start by reviewing your current systems, controls, policies, and evidence to identify gaps. That assessment informs the scope, remediation plan, and preparation work for your first SOC 2 examination.

  1. Step 1: Scope and criteria

    Define the service, systems, people, vendors, and commitments to be examined, and discuss the Trust Services Criteria and report type with your CPA firm.

  2. Step 2: Controls and policies

    Design controls that fit your environment and draft policies and procedures that match how the work is actually done.

  3. Step 3: Remediation

    Record each gap with its basis, owner, and target date. Your team makes the technical changes; we track them to a verified close.

  4. Step 4: Evidence

    Agree what each control should produce and check records for scope, period, reviewer, and follow-up while there is time to correct them.

  5. Step 5: Examination preparation

    Organize the evidence index, system-description inputs, and open items, and coordinate requests with the CPA firm.

GetComply and your CPA firm

GetComply

Prepares the program and its records, reviews evidence before it goes to the firm, and coordinates the requests within our engagement.

Independent CPA firm

Determines the examination procedures, decides whether evidence is sufficient, and issues the SOC 2 report and opinion. You choose and contract the firm.

Because the firm reaches its own conclusions on its own schedule, we can't guarantee an opinion or a report date.

Timing

Launch Readiness is generally planned over four to six months. The actual timeline depends on existing controls, the remediation required, management decisions, the report type, and the CPA firm's schedule. A Type II report also needs an observation period during which controls operate.

Type I and Type II explained

Price

$4,500/ month

For the agreed engagement period. Examination fees are separate and paid to your CPA firm. The one-time Readiness Assessment is optional; you can start Launch Readiness directly.

Launch Readiness terms

After the examination

SOC 2 controls have to keep operating: access reviews, vendor reviews, policy updates, and evidence for the next period. Some companies run that work internally. Others use Managed GRC, which can also start without a Launch Readiness engagement.

SOC 2 resources

Discuss your SOC 2 timeline

Tell us what your customer asked for, when they need it, and what is already in place.
Request an intro call Check your readiness