Scope the criteria honestly
Security is mandatory; we recommended adding Confidentiality only, because that is what customers were actually asking about. Availability could wait a year.
Ready for the auditor before the auditor arrived
Forty employees, no security hire, and three enterprise deals stalled on the same question: do you have a SOC 2 report?
Representative engagement. Client names, figures and identifying details are changed or combined; no client findings are published in identifiable form.
- Sector
- SaaS and technology
- Engagement
- SOC 2 readiness
- Frameworks
- AICPA Trust Services Criteria (Security, Confidentiality), OWASP ASVS 5.0
- Duration
- 14 weeks
A B2B HR software company.
The company had good engineering habits and almost no documentation of them. Access reviews happened in someone’s head; change approval happened in pull requests nobody would call a control.
They had chosen a CPA firm for a Type I examination and wanted to go straight on to Type II.
Write down what already works, fix what does not.
Turn habits into evidence
Existing pull-request reviews, on-call rotations and onboarding checklists were mapped to criteria and wired to collect evidence automatically, rather than rebuilt as paperwork.
Test before the auditor tests
A penetration test and a mock audit ran in week ten, so the gaps the auditor would have found were already closed.
What we found
Gaps found at mock audit.
| Severity | Finding | Maps to | Status at retest |
|---|---|---|---|
| High | No periodic access review for production; four former contractors still had database access. | TSC CC6.2 / CC6.3 | Closed |
| High | Customer data in a staging environment without the production access controls. | TSC C1.1 · CC6.1 | Closed |
| High | Admin impersonation feature not logged. | TSC CC7.2 · ASVS V16 | Closed |
| Medium | Vendor risk reviews not performed for sub-processors. | TSC CC9.2 | Closed |
| Medium | Security awareness training not tracked for completion. | TSC CC1.4 / CC2.2 | Closed |
What changed.
The Type I examination completed with no exceptions, and the Type II observation window started the following month. The report itself was issued by the client’s CPA firm.
Two of the three stalled deals closed within the quarter. The evidence collection now runs without anyone thinking about it.
Want this for your application?
Tell us what you ship and who is asking for proof. We will come back with a scope and a range.
Let’s Connect
or email hello@penspycyber.com