What is the difference between SOC 2 Type 1 and Type 2?

Type 1 reports on whether your controls are suitably designed at a single point in time. Type 2 reports on whether they also operated effectively over an observation period, typically three to twelve months. Most enterprise buyers ask for Type 2.

Does Whitesec AU issue the SOC 2 report?

No. A SOC 2 report must be issued by an independent licensed CPA firm. We prepare you for the examination and support you through it, and the firm that attests to your controls stays independent of the firm that prepared you.

How long does it take to get a SOC 2 Type 2 report?

Readiness work commonly takes two to four months depending on your starting point. The observation window then runs for its chosen period, followed by the auditor's fieldwork and report drafting. Plan on most of a year end to end for a first report unless you already run strong controls.

Which Trust Services Categories do we need?

Security is always included. Availability, Processing Integrity, Confidentiality, and Privacy are added based on what you promise customers. We help you choose the smallest set that satisfies your buyers, because each added category adds controls to test.

We already have ISO 27001. How much of that carries over?

A substantial share of the control and policy work overlaps. SOC 2 still has its own system description, its own criteria wording, and a different testing approach, so we map what you have, close the differences, and avoid rebuilding what already works.

Service Organisation Assurance

SOC 2 Type 2 Readiness

A SOC 2 Type 2 report is the assurance document enterprise buyers ask for by name. We scope it, build the controls, keep the evidence flowing through the observation window, and hand you to your independent CPA firm audit-ready.

Recommended For

SaaS platforms, data processors, and managed service providers selling to enterprise or US customers who require a SOC 2 report
Australian technology firms that already hold ISO 27001 or run to the Essential Eight and want to reuse that work toward SOC 2
Founders and CTOs facing a vendor security review with a deal deadline and no existing control evidence

Service Overview

Prepared for the Auditor Before the Clock Starts

SOC 2 is an attestation report, not a certificate. It is issued by an independent CPA firm after testing your controls against the AICPA Trust Services Criteria. A Type 1 report covers the design of controls at a point in time. A Type 2 report covers whether those controls operated effectively across an observation window, and it is the one most enterprise buyers actually want.

Whitesec AU does the work that happens before and around the audit: scoping the system and the criteria, building and documenting the controls, setting up evidence collection so the observation window produces clean proof, and running a readiness review before your auditor arrives. We do not issue the report. Consultancy and attestation stay separate, so the firm that signs your report is genuinely independent of the people who prepared you.

3 to 12 months

The observation window a Type 2 report typically covers. Evidence collection has to start on day one of it.

Regulatory & Standards Alignment

AICPA Trust Services Criteria (2017, revised points of focus 2022)

The criteria a SOC 2 examination is performed against. Security (the common criteria) is mandatory; Availability, Processing Integrity, Confidentiality, and Privacy are added by scope.

SOC 2 Type 2 examination under AICPA attestation standards

An independent licensed CPA firm tests the design and operating effectiveness of your controls over an observation period and issues the report.

Mapping to ISO/IEC 27001 and the ASD Essential Eight

Much of the control work overlaps with controls Australian organisations already run, so we map existing evidence instead of rebuilding it.

What You Walk Away With

A Defensible Scope

A system description and criteria selection that match what you sell, so you are not audited against controls that do not apply.

Controls That Match the Criteria

Policies, access control, change management, vendor management, and monitoring written to the Trust Services Criteria and sized to your team.

Evidence Collected as You Go

Recurring evidence such as access reviews, change tickets, and vulnerability scans is captured on schedule, not reconstructed at audit time.

Reuse of Existing Frameworks

ISO 27001, Essential Eight, and SMB1001 work is mapped across, which shortens the build for organisations that already hold one.

Auditor-Ready Handover

A clean readiness review and an organised evidence file, so your CPA firm spends the engagement testing rather than chasing documents.

A Position for Vendor Reviews

Straight answers for customer security questionnaires while the observation window is still running.

The Problem

Challenges We Solve

The situations that bring organisations to this engagement in the first place.

A buyer wants the report before they sign

Enterprise and US-headquartered customers send a security review that ends in one question: do you have a SOC 2 Type 2 report? Without one, deals stall in procurement.

Type 2 is about time, not a snapshot

A Type 2 auditor tests that controls operated effectively across a period, not that they existed on one day. Evidence that was never collected cannot be recreated afterwards.

The criteria are broad and open to interpretation

The Trust Services Criteria do not prescribe specific tools. Teams over-build, under-build, or build the wrong thing because nobody has translated the criteria into concrete controls.

Scope of Service

Scope of SOC 2 Type 2 Readiness

Four stages that take you from first scoping call to audit-ready.

Scoping & Gap Assessment

Define the in-scope system, choose the Trust Services Categories, and score your current controls against the criteria.

Control Design & Documentation

Write the policies and procedures, configure the technical controls, and assign an owner and evidence source to each one.

Observation-Window Support

Set up evidence collection and run periodic check-ins so gaps are caught while there is still time to correct them.

Pre-Audit Readiness Review

A mock walkthrough of the auditor's testing, then support while your independent CPA firm completes the examination.

Methodology

Engagement Roadmap

A sequence built around the observation window, because that is the part that cannot be rushed or repeated.

Scope

Confirm the system boundary, the Trust Services Categories, the target report date, and which CPA firm will perform the examination.

Assess

Gap analysis against the criteria. Findings are scored and mapped to a control owner, not just listed.

Build

Policies, technical controls, and evidence collection put in place before the observation window opens.

Operate

Controls run through the window with periodic reviews. We flag drift and missing evidence as it appears.

Pre-audit & handover

Readiness review, organised evidence file, and live support while the CPA firm tests your controls.

Deliverables

What You Receive

The artifacts that land in your hands at the end of the engagement.

System Description & Scope Statement

A draft system description, boundary definition, and criteria selection ready for your auditor's review.

Control Matrix & Policy Set

Each criterion mapped to a control, an owner, and an evidence source, with the supporting policies written.

Evidence Calendar & Readiness Report

A schedule of recurring evidence for the observation window, and a pre-audit findings report with remediation status.