The deal is stuck in vendor review
An enterprise customer's security team asked for your SOC 2, and the deal will not move until something credible answers them. Readiness done right is how the deal un-sticks.
SOC 1 + SOC 2 readiness
The enterprise deal wants a SOC report. Walk in ready.
SOC reports are issued by licensed CPA firms after an audit. Our job is everything before that: the gap work, the policies, the evidence, and the coordination, so the audit is a formality instead of a fire drill.
Book a 30-minute scope call
Scope, timing, and fees are documented before work begins.
- AttestedA licensed CPA firm issues the report, never us
- 4–9 monthsTypical timeline; Type II adds an observation window
- SOC 1 or SOC 2Finance-audit driven, or security driven; we route you right
- Pen testAuditors expect one; delivered by an independent partner
Why companies book this now.
Type I vs Type II confusion
Type I says your controls were designed properly on a date. Type II says they operated over months. Customers increasingly want Type II, which means evidence discipline, not paperwork heroics the week before.
Automation tools are not a program
Compliance platforms collect evidence; they do not decide scope, write true policies, or run your program. Somebody accountable still has to do the thinking. That is the part we do.
Best fit: service businesses and SaaS companies of 25 to 200 people whose enterprise customers or partners are asking for a SOC report, with leadership willing to actually operate the controls.
Not the right fit: companies wanting a certificate without changing anything, or needing the audit itself; the audit is performed by a licensed CPA firm we help you select and prepare for.
SOC 1 or SOC 2, Type I or Type II: routed plainly.
SOC reports are attestations under AICPA standards, issued by licensed CPA firms after an audit. SOC 2 covers the Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy) and is what customer security teams mean by 'your SOC report.' SOC 1 covers controls relevant to your customers' financial reporting; billing services, payroll processors and claims administrators get asked for it by their customers' finance auditors.
The routing question is simply who is asking: a security or vendor-risk team means SOC 2; a controller or financial auditor means SOC 1. Type I attests your control design at a point in time; Type II attests the controls operated over an observation window of several months, which is why the calendar, not the paperwork, is the real project.
Readiness is everything before the CPA firm arrives: scoping which criteria apply, closing the gaps, writing policies people actually follow, collecting evidence continuously through the window, coordinating the independent penetration test auditors expect, and preparing your team for fieldwork.
What you get.
Every engagement includes
- SOC 1 vs SOC 2, Type I vs Type II routing
- Gap assessment against the applicable criteria
- Readiness roadmap sequenced to your deal or audit date
- Policy program written and adopted
- Evidence collection system through the observation window
- Independent penetration test coordination (partner)
- Vendor management and training programs the criteria require
- CPA audit firm shortlist and selection support
- Fieldwork preparation and audit-week support
Example readiness tracker
HW / SOC READINESSTrust Services gaps
GapAccess reviews not evidenced30 days
PartChange management informal60 days
ReadyVendor reviews operatingwindow opens
Illustrative structure only. Your findings, owners, evidence, and priorities are based on your environment.
See what your scope includesThree phases to audit-ready.
01
Route and scope (weeks 1 to 2)
Which report, which type, which criteria, and the readiness plan sequenced backward from your deadline. Price fixed in writing.
02
Close gaps and run the window (2 to 8 months)
Policies adopted, controls operating, evidence accumulating, pen test done by an independent partner. Your team executes; we direct and verify.
03
The audit (CPA firm)
We help you choose the audit firm, hand over a clean evidence package, and support your team through fieldwork. The CPA firm issues the report.
How pricing works
Priced by scope. Fixed in writing.
Your quote is built from your headcount, your systems, and how far you are from the bar. It is fixed in writing at the free 30-minute call, before any work starts, and it never changes after you approve it.
Separately scoped, always disclosed
The CPA firm's audit fee and the independent penetration test are third-party engagements, quoted by those firms and never hidden inside ours. Compliance-automation tooling is optional; when it helps, you buy it directly and we run it, and we take no commission from anyone.
Questions we hear about this service.
No, and nobody who is not a licensed CPA firm can. We do the readiness: gaps, policies, evidence, coordination, and audit prep. Then a CPA firm you choose (we help you shortlist) performs the audit and issues the report. That separation is how the system is designed to work.
Ask who wants it. A customer's security or vendor-risk team wants SOC 2. A customer's finance team or their financial auditors want SOC 1, which applies when your service affects their financial reporting, like billing, payroll or claims processing. We route you in the first call.
Type I: often 3 to 5 months. Type II: readiness plus an observation window of 3 to 12 months, then the audit, so plan 6 to 12 months. The biggest schedule lever is starting the window early, which is why readiness should begin the week the customer first asks.
The criteria do not name one explicitly, but CPA auditors expect vulnerability management evidence and most expect a pen test. Ours is delivered by an independent testing partner, never by us, so the evidence carries an outside firm's name.
Book your scope call.
Thirty minutes with an advisor.
We cover your organization, your deadline, and who is asking for what. You leave knowing the likely scope, the timeline, and your next step, with the price fixed in writing before any work starts.
Prefer phone or email?
(754) 216-9664 info@hardenwell.com
Do not include PHI or sensitive records in booking notes. See our Privacy Policy.