02 / Compliance and certification
SOC 2, ready before the auditor asks for the first sample
We help you scope the examination, design controls that match the Trust Services Criteria and collect evidence that holds up, so the CPA firm audits a system that already runs.
Overview
What a SOC 2 report is
A SOC 2 report is an attestation report on a service organisation's controls, examined against the Trust Services Criteria of the AICPA. Security is always in scope. Availability, processing integrity, confidentiality and privacy are added when they matter to your customers.
A Type 1 report covers your system description and whether the controls are suitably designed at a point in time. A Type 2 report also tests whether they operated effectively over a period, which means the evidence has to exist for the whole period, not just the week before fieldwork.
The report is issued by a licensed CPA firm. Black Fox is not one. We do the work before it: readiness, gap assessment, control design and evidence preparation, so the examination finds a system and not a project. We work with long-standing partner firms and coordinate the examination with them or with a CPA firm of your choice, so you go from readiness to the report in one engagement.
Who it is for
Service providers, most often SaaS and cloud companies, whose customers ask for a SOC 2 report in security reviews or contracts, and teams preparing for their first Type 1 or moving from Type 1 to Type 2.
The work, from scoping to evidence.
What we do
Scoping
We help you choose the system boundaries, the criteria categories and the report type, based on what your customers actually ask for.
Readiness assessment
A review of your controls against the Trust Services Criteria, with gaps ranked by risk and effort.
Control design
Controls written so an auditor can test them: an owner, a frequency, a clear description and the evidence they leave behind.
System description
Support in drafting the description of your system, its boundaries, its subservice organisations and the controls you expect your customers to run.
Evidence preparation
A list of what the auditor will ask for and where it comes from, with access reviews, change records and similar evidence collected as you go.
Technical checks
Where useful, penetration tests, access reviews and vulnerability reviews that feed your controls with real results.
How the engagement runs
Kickoff
We agree the system in scope, the people involved and your target report date, and sign an NDA first if you need one.
Readiness assessment
Interviews, document review and sampling, ending in a prioritised gap report.
Control design and remediation
We work with your owners to close gaps and write controls that can be tested.
Dry run
We sample evidence the way an examiner would and tell you what would not survive.
Examination
We coordinate the examination with one of our long-standing partner firms or the CPA firm of your choice, and help you answer requests and work through exceptions during fieldwork.
What you receive
- Scoping memo: system boundaries, criteria and report type
- Readiness assessment report with a prioritised action plan
- Control matrix mapped to the Trust Services Criteria
- Draft input for the system description
- Evidence request list with owners and sources
- Dry-run findings before the examination
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Can Black Fox issue our SOC 2 report?
No. SOC 2 reports are issued by licensed CPA firms under AICPA attestation standards, independent of our readiness work. We prepare you for the examination, coordinate it with one of our long-standing partner firms or a firm of your choice, and support you during it.
Type 1 or Type 2?
Type 1 looks at control design at a point in time. Type 2 also covers operating effectiveness over a period. Many organisations start with Type 1 and move to Type 2, but what your customers will accept should decide.
Which Trust Services Criteria do we need?
Security is always included. Add availability, processing integrity, confidentiality or privacy where your commitments to customers depend on them. More categories mean more controls to evidence.
Is SOC 2 the same as ISO/IEC 27001?
No. ISO/IEC 27001 is a certification of a management system. SOC 2 is an attestation report on controls. They overlap a lot, and one set of controls can often serve both.
Related services
- Compliance and certificationSOC 1SOC 1 readiness from Black Fox Security: control objectives, IT general controls, gap assessment, control design and evidence preparation for your CPA firm.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Managed securityContinuous complianceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.
- Managed securityAccess reviewsPeriodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence.
Find out how far you are from a clean examination
Tell us what your customers are asking for and when. We will show you what stands between you and the report.