A SOC 2 Type 1 report in eight weeks for a SaaS company selling to US enterprises

The challenge

A US enterprise prospect sent a security questionnaire and asked for a SOC 2 report before signing. The company had no formal security programme and no time to spare, with its team split between the US and India.

What we did

• Scoped the system and chose the Trust Services Criteria the customer actually needed, instead of adding all five.
• Ran a gap assessment against the criteria and agreed which controls applied, which were shared with the cloud provider and which were not applicable, with written reasons.
• Set up the controls on Thoropass and guided the team as they implemented MFA, access reviews, change management, logging, vendor reviews and incident response.
• Shared policy templates the team tailored to how they work.
• Ran a readiness check before fieldwork, then coordinated the examination with an independent, licensed CPA firm.

Timeline

1. Scoping and gap assessment
2. Remediation and evidence collection on Thoropass
3. Readiness check and CPA firm fieldwork
4. SOC 2 Type 1 report issued, eight weeks after kickoff

Results

• SOC 2 Type 1 report issued eight weeks after kickoff.
• No exceptions in the Type 1 report.
• A report the company could share with its US enterprise prospect.
• The client's Type 2 observation period started straight after the Type 1 report.

What made it work

Keeping the criteria to what customers asked for kept the work and the audit fee proportionate, and running everything on one compliance platform meant both the US and India teams worked from the same controls and evidence.