Technology and service companies
Your largest customers ask for SOC 2, an independent report on how secure your systems are, before they sign. DM11 gets your company ready to reach the audit with controls working and proof on hand, and to walk away with the report that closes the deal.
DM11 prepares your company. The SOC 2 report is issued by an independent CPA firm (a licensed public accountant in the United States) that you hire directly. A rule of independence stops whoever builds the controls from auditing the same client.
Who runs the preparation
How it actually works
You get a document that answers your customers' security questions on its own: a report with your controls tested one by one by an independent auditor. The market calls it a certification and we understand the request, but the technical name is different, and it explains the format. It is an attestation report, issued under the standards of the American Institute of Certified Public Accountants (the accountants' body in the United States, the AICPA) by a licensed CPA firm. Knowing that changes what you hire, from whom, and what you can expect to receive at the end.
The result is a document with five sections. Among them are the system description, written by your company, and the auditor's test results, control by control. Your customer will read it, especially the part that shows the problems found. It is not a one-page PDF with a logo.
A consultancy does not sign SOC 2 reports, and neither do we. The audit firm is hired separately, by you. The AICPA rule of independence explains why: whoever built the controls cannot audit the same client. In practice that means two contracts and two budgets, and it is better to know while planning than to find out midway.
The report most often requested does not assess how your company looks today: it assesses how it worked over months. Which means preparation does not end when a control is built, but when it has produced consistent proof across the whole period observed.
The first decision
This choice sets cost, timeline and what you can actually show a customer. It is also where the market's most expensive misunderstanding circulates.
How the controls are designed
Checks whether the controls are well designed and in place on a given date. It is a snapshot. It shows you are serious quickly and often unblocks a contract while Type II is still under way. It says nothing about the controls having worked over time, and experienced buyers know that.
How they were designed and how they worked
Checks whether the controls were well designed and whether they actually worked over a period. It is the report most large customers require. The period is agreed between you and the auditor, and the market tends to treat three months as the minimum, with six to twelve months most accepted by demanding buyers.
The idea gets around that Type I is a prerequisite for Type II. It is not. Your company can go straight to Type II, and many do, to save time and a whole project. Doing Type I first is a commercial decision, and a good one: when a contract is waiting and you cannot sit out the observation period, it unlocks the signature.
Scope
Security, the group of common criteria, is in every SOC 2. The other four are eligible add-ons: you choose them based on what you already promise in contracts and what the market you sell to will demand. Eligible does not mean skippable. It is your call, and the call has an expiry date, because every category included later needs its own observation period. That is why the cheapest moment to include one is now, alongside the rest.
| Category | Eligibility | Why it is worth including |
|---|---|---|
| Security | Mandatory | The group of common criteria, organised into nine blocks that run from the control environment to vendor management. It is the backbone of any SOC 2 report, and on its own already meets much of what customers ask for. |
| Availability | Eligible | You already promise availability in your contracts: the service level agreement (the SLA) is signed with or without SOC 2. This category is what proves the promise holds, covering capacity, recovery and testing of the plan. Leaving it out tends to last until the first renewal with a large account, which asks for exactly this. |
| Confidentiality | Eligible | Worth it whenever a customer marks some information as confidential and expects to see it protected by agreement, which in practice is almost every enterprise contract. It covers identifying, keeping and disposing of that information. It is the category with the least extra effort for anyone who has done Security, because it reuses much of the same set of controls. |
| Processing integrity | Eligible | Needed when your service processes a transaction or calculation on the customer's behalf and the result has to be complete, accurate and authorised. In payments, payroll, billing and logistics, it answers the question the customer really has: is the number coming out of here correct? Security alone does not answer that. |
| Privacy | Eligible | It comes in when you handle personal data, and buyers ask for it more and more as privacy law tightens. It covers part of what the law requires and does not replace a privacy programme, but it shows the customer, backed by a third party, exactly the part they push hardest on when reviewing you. |
The calculation people usually get wrong: adding a category in the next cycle does not cost a little more, it costs a whole observation period just for it, and until then you tell the customer it is not covered. It is worth asking the customer, in writing, what they expect to receive, and deciding the scope while also looking at the contracts you want to win over the next two years.
The real timeline
The total timeline is almost never published, and it is exactly the one that matters when a contract is waiting. The phases below happen one after another, and it is the sum of them that you need to agree with your customer.
Comparing your situation with the criteria, defining categories, systems and environments, and the choice between Type I and Type II. It ends with a plan and the scope on paper.
The phase with the least predictable length, and the biggest risk of blowing the timeline. It depends entirely on how much already exists. A company with governance in place moves fast; one that never formalised anything has groundwork to do.
It only exists in Type II, and it is calendar time you cannot shorten. The controls have to work and produce proof across the whole period agreed with the auditor.
The CPA firm tests the controls, examines the proof and talks to the team. This is where the difference shows up between the process on paper and the one done for real.
Writing, your company's response to any problems found, and delivery. The document comes out in English when the firm is American, which is usually the case.
We do not publish a standard timeline because it would be a guess: the fixes vary too much from one company to another, and the observation period is a scope choice. What can be said with confidence is that a Type II does not come out in weeks, because the observation period is calendar time you cannot shorten. After the diagnosis, we can put dates on your case precisely enough for you to commit to the customer.
Who does what
A SOC 2 project involves four parties, each signing something different. We make the split clear before the proposal so there is no surprise about scope or fees later.
Self-assessment
Eighteen questions across the control groups the report examines. The full result appears on screen, with a score per group and what closes the biggest gaps. We do not ask for your email to show it.
The report starts with the control environment, where the audit tests culture with a document in hand.
How we run it
Every phase ends with something delivered. You know what you get before you start.
We turn your customer's requirement into a report type, categories, systems and period. It is the decision that moves cost and timeline the most, and the one most often rushed.
You get
We assess where you stand today control by control, using the same checklist we use in audits, to show the real distance rather than an impression.
You get
We put in place, together with your team, what is missing: policies, access processes, changes, monitoring, incident response and vendor management.
You get
In Type II the auditor tests the whole period, so the proof has to come out of day-to-day work. We define what is produced, by whom and how often, before the period starts.
You get
We help write the section of the report that is your company's responsibility, including the system boundaries, the commitments made and the role of the partners.
You get
We simulate the audit with the same rigour as the auditor before they arrive, and we support the CPA firm's fieldwork, including your company's response if there is any problem.
You get
Stories
We hide the clients' names with the same confidentiality that will protect your company later. The names change, and the pattern of the problems repeats.
Scoping
Twelve questions about what sets the size of a SOC 2 project. At the end you review your answers, correct anything you want, and get a proposal built on that, without needing a meeting just to find out the basics.
If the request does not say, it is worth confirming before pricing.
Frequently asked
Answers based on the standards of the AICPA (the accountants' body in the United States). Where no official figure exists, we say so.
You can, and almost everyone does. When your customer asks for a SOC 2 certification, we know exactly what they want. The technical name, though, is an attestation report, issued under the standards of the American Institute of Certified Public Accountants (the accountants' body in the United States), and the difference matters on three practical points. Who signs it: only a licensed CPA firm, never a consultancy. What you receive: a report of several sections that the customer will read, including the tests control by control, and not a one-page certificate. And the timeline: because the most requested report covers a period of working, it does not shorten the way a traditional certification audit does. Knowing this changes what you hire and from whom.
More questions? Talk to DM11
A thirty minute conversation is usually enough to settle report type, categories and a rough idea of the effort involved. No obligation.