Service
SOC 2 readiness for startups and growing companies.
Intragreat is a SOC 2 readiness consultant for startups and growing companies with little or no IT team. We assess where you stand against the Trust Services Criteria, then build the technical controls auditors test: identity, devices, logging, offboarding, and backups. We are not a CPA firm and we do not issue your report. We get the technical side ready, then work alongside your auditor.
Who It Is For
Practical support for growing businesses.
For companies whose customers have started asking for a SOC 2 report, and who need to know what it takes before they choose an auditor or a compliance platform.
Problems Solved
What Is Included
Clear scope and plain-language documentation.
SOC 2 readiness assessment and gap list
Scope and Trust Services Criteria recommendations
Entra ID, MFA, and access review setup
Device management, encryption, and patching evidence
Logging, offboarding, and backup testing
Support during your auditor’s evidence requests
When You Need This
Signs it’s time to bring this in.
SOC 2 readiness checklist
This is the technical and operational work most first-time SOC 2 audits touch. Your auditor decides what evidence satisfies them, so treat it as a place to start, not a guarantee.
- Scope: name the systems, data, and teams in scope, and choose your criteria. Security is required, and the others (Availability, Confidentiality, Processing Integrity, Privacy) are added only if customers need them.
- Risk assessment: write down your risks and what you do about them, and review them on a schedule.
- Access: enforce MFA everywhere, remove standing admin rights, and review access quarterly with a dated record.
- Joiners and leavers: use a documented onboarding process, and remove access promptly when someone leaves.
- Devices: manage every laptop, enforce encryption and screen lock, and keep patch status you can export.
- Logging: keep sign-in, admin, and system logs long enough to investigate an event, and show that someone reviews alerts.
- Vulnerabilities and change: track patching and fixes, and show that production changes are reviewed.
- Vendors: list the vendors that touch customer data, and collect their security reports.
- Incident response: write a plan, assign owners, and run a test.
- Backups: test a restore and keep the result.
- People: complete security training and policy acknowledgments, and keep the records.
- Auditor: choose an independent CPA firm early, and agree on the report type and observation period.
Type 1 or Type 2?
A Type 1 report looks at whether your controls are designed properly at one point in time. A Type 2 report also tests whether they worked over an observation period, commonly three to twelve months. Many enterprise buyers ask for Type 2, and some will accept Type 1 while yours is under way. Ask the customer driving the request what they will accept before you plan around either one.
Related Services
FAQ
Common questions.
What is a SOC 2 readiness assessment?
It is a gap analysis you do before the audit. We compare your current controls with the Trust Services Criteria you have chosen and give you a prioritized list of what to fix, with owners. It is not an audit and does not produce a SOC 2 report.
Does a startup need SOC 2 compliance?
Only when customers require it. SOC 2 compliance for startups usually comes up when you start selling to larger companies. If a security questionnaire is enough for your current deals, build the controls first and start the audit when a deal justifies the cost.
Can you issue our SOC 2 report?
No. Only an independent CPA firm can issue a SOC 2 report, and we are not one. We prepare the technical controls and evidence, and work alongside your auditor.
Do we still need help if we bought a compliance platform?
Often, yes. A platform tracks evidence and flags failed checks, but someone still has to configure Entra ID, enroll laptops, and fix what it flags. That is the part we do.
How long does SOC 2 readiness take?
It depends on your starting point, and we will give you an estimate after the assessment. The fixed part is the Type 2 observation period, commonly three to twelve months, which cannot start until your controls are operating.