We start from the buyer’s clause, fix the report type and system scope, make controls operate and evidence accrue on time, then hand over to an independent CPA. The CPA issues the report; we get you ready for it.
By · AssureLane ResearchUpdated · Sources checked · 2026-10-10
Map current state to the criteria; find policy, control and evidence gaps
2–3 weeks
3. Remediation
Access, change, logging, backup, vulnerability, vendor and people controls in place
1–3 months
4. Readiness review
Auditor-style sampling; fix residual issues; book the CPA
1–2 weeks
5. Examination
Type 1 at a point in time; Type 2 after the observation period
Type 2 period 3–12 months
Plan backwards. Type 2 evidence must be produced during the period; it cannot be written afterwards. If the deadline is tight, start the period early and ask the buyer whether interim material is acceptable.
What drives cost
Advisory and readiness work, the CPA’s fee, optional tooling and optional testing. Ask every bidder whether the CPA fee is included, whether Type 1 and Type 2 are priced separately, and whether support during the period is charged. Our quotes itemise each.
Who does what
Only an independent CPA can issue a SOC 2 report, and the readiness adviser cannot audit the same engagement. On AssureLane projects, readiness work is delivered by our partner firm; AssureLane scopes, coordinates and stays your single point of contact.
Who does what
01
AssureLane
Scoping, proposal coordination and project follow-through — your single point of contact.
02
Delivery partner
Professional delivery: gap assessment, policies and controls, evidence preparation, readiness review and coordination with the external auditor.
03
Independent firms
Independent CPAs issue SOC 2 reports; accredited bodies make ISO certification decisions. Advisers never issue either or guarantee outcomes.
Many buyers accept a Type 1 plus a Type 2 timeline in year one, but it depends on their vendor policy. Confirm in writing before choosing.
How short can the observation period be?
Three months is a common minimum; six or twelve months are more typical and more persuasive for large buyers. Agree the period with the CPA and the buyer.
Do we need Vanta or Drata?
No. Automation helps cloud-native teams with many integrations; smaller teams can succeed with spreadsheets and tickets. We advise based on your setup and do not bundle tools.
General information only; not legal, audit or certification advice. Applicability, scope and professional responsibilities depend on your circumstances.