Security & compliance services for China-based companies going globalReports and certificates issued by independent CPAs and certification bodies
AssureLane
中文Book a scoping call
How we work

Seven phases. Clear owners and outputs at every step.

Shown for SOC 2 and ISO/IEC 27001. Names differ by framework, but the logic — scope, build, audit, maintain — is the same.

  1. 01

    Scoping call

    AssureLane30–60 min

    • Read the buyer clause, questionnaire or market rule
    • Decide: report, certificate, legal programme or questionnaire answers
    • Confirm entities, products, systems and deadline

    OutputScoping note: frameworks, priorities and recommended path

  2. 02

    Scope & proposal

    AssureLane + delivery partnerDepends on scope

    • Define audit scope, report type or certification scope
    • Assess existing policies, tools and team
    • Itemise advisory, audit, tooling and travel costs

    OutputStatement of work and itemised quote from the delivery partner

  3. 03

    Gap assessment

    Delivery partner2–4 weeks

    • Map current state to each requirement
    • Identify policy, technical and evidence gaps
    • Prioritise by risk and deadline

    OutputGap report and remediation roadmap

  4. 04

    Build controls

    Delivery partner + your team1–4 months

    • Write and revise policies and procedures
    • Implement access, change, logging, backup and vendor controls
    • Set up the evidence register and owners

    OutputPolicies, control matrix, evidence list

  5. 05

    Readiness review

    Delivery partner1–2 weeks

    • Sample controls and evidence as an auditor would
    • Mock interviews and fix residual issues
    • Confirm the audit plan with the CPA or certification body

    OutputReadiness conclusion and audit kick-off

  6. 06

    Independent audit

    Independent auditorPer audit plan

    • SOC 2: the CPA performs the examination and issues the report
    • ISO: Stage 1 and Stage 2 audits and certification decision
    • Delivery team supports evidence requests

    OutputSOC 2 report or ISO certificate (issued independently)

  7. 07

    Ongoing compliance

    AssureLane + delivery partnerYearly

    • Next SOC 2 Type 2 period
    • ISO surveillance audits and recertification
    • New questionnaires, trust centre and change review

    OutputAnnual plan and audit continuity

Durations are typical ranges and depend on scope, team capacity and starting point; a Type 2 report also requires an observation period.

Contracts & fees

Who you contract with, and who you pay.

The professional services contract is signed directly with our delivery partner, which carries delivery responsibility; we disclose the partner’s legal entity and credentials before signing. Independent audit or certification fees are contracted or itemised separately. AssureLane handles scoping, coordination and communication throughout.

A typical quote has

  • Advisory and readiness fees
  • Independent audit or certification fees
  • Optional: automation tooling, penetration test, training
  • Optional: annual upkeep and surveillance support
Next step

Your buyer is waiting. Start with a clear scope.

A 30-minute scoping call: confirm whether the buyer needs a report, certificate or questionnaire answers, what is in scope, and a realistic timeline.

Book a scoping callTry the 2-minute check