SOC 2 Readiness and Compliance Services
- Readiness is the phase before the examination. It establishes what is met, what is not, and what closes each gap.
- A readiness assessment should produce findings, not an opinion. "These requirements are met, these are not" is defensible. "You are ready" is a warranty.
- Commission it before booking an audit window, so remediation happens on your timetable rather than the auditor's.
- A gap found during audit fieldwork costs more than the same gap found in readiness, because the auditor bills the extra time and may require a re-test.
- Readiness typically costs $5,000 to $25,000 and takes two to four weeks.
What readiness and compliance services cover
SOC 2 readiness services establish where you stand before an accounting firm examines you. The output is a requirement-by-requirement view: which criteria are already met, which are not, what evidence exists, what evidence is missing, and what specific work closes each gap.
Compliance services then cover the work that follows, taking those findings and turning them into operating controls, written policies, retained evidence and a company ready for examination.
The two are frequently sold together and they are genuinely sequential. Doing the second without the first means fixing problems you have not yet identified.
What a readiness assessment should contain
| Element | What good looks like |
|---|---|
| Scope statement | The systems, services and criteria assessed, and what was deliberately excluded |
| Requirement-by-requirement findings | Each criterion listed, with your current evidence and a plain judgement of whether it meets the standard |
| Gap descriptions | What is missing, described specifically enough to act on without further interpretation |
| Remediation plan | What closes each gap, who does it, and roughly how long it takes |
| Evidence framework | What must be collected during the observation period, by whom, on what schedule, and in which system |
| Timetable | A realistic path to the examination, including the earliest defensible observation period start |
| Delivery call | A conversation, not just a document, where the judgement calls get explained |
The findings should be stated as findings rather than as an opinion. A report that says "these requirements are met, these are not, here is what closes them" is defensible and useful. A report that says "you are ready" is a warranty that lands on the firm that wrote it, which is why serious practitioners do not write it.
When to commission readiness
Before you book the audit window, and before you speak to accounting firms about fees.
Two reasons. First, the auditor prices from your scope and your maturity, so knowing both produces an accurate quote instead of an optimistic one. Second, a gap discovered during fieldwork is more expensive than the same gap found earlier: the auditor bills for the additional time, remediation happens under deadline pressure, and in some cases the control has to be re-tested, which extends the observation period and pushes the report out by months.
Our readiness and gap assessment is delivered as a fixed fee with a delivery call for exactly this reason. You know the number before the work starts.
Readiness versus the examination
These get conflated in conversation and they are entirely different engagements.
Readiness is advisory. Its purpose is to help you. The firm doing it can tell you what to fix and how.
The examination is independent. Its purpose is to form an opinion. The accounting firm performing it is not permitted to advise you on how to close the gaps it finds, because doing so would compromise the independence its opinion depends on.
That constraint is the practical reason readiness exists as a separate service. Your auditor cannot both help you prepare and independently assess the result.
What compliance services cover after readiness
The remediation phase turns findings into a company that can be examined. Policies written to describe how your organisation actually works. Controls configured so they operate and leave a dated record when they do. Vendor inventory built and reviewed. Incident response plan written and tested. Evidence collection established in the systems where the work already happens.
Then the project management that holds it together: chasing the owners, keeping the schedule, selecting the accounting firm, briefing the people who will be interviewed, and handling findings during fieldwork. That is our implementation service, and in most programmes it is the largest share of the effort.
Cost and timing
| Service | Typical cost | Typical duration |
|---|---|---|
| Readiness assessment | $5,000 to $25,000 | 2 to 4 weeks |
| Remediation and build | $15,000 to $50,000 | 6 to 16 weeks, depending on gaps found |
| Examination support | Usually within the programme fee | Alongside and after the observation period |
The readiness fee scales with scope and system count rather than headcount. A company with one product on one cloud account sits at the lower end regardless of how many people it employs.
What readiness commonly finds
The same items recur across almost every first assessment.
Access reviews happening informally, with no retained record. Change approvals performed in practice but not evidenced in a way an auditor can sample. Policies inherited from a template that describe processes nobody follows. No vendor inventory, or one that has not been reviewed in a year. An incident response plan that exists but has never been tested. Offboarding that removes the main account but leaves access in three secondary systems. And no single person who owns the programme.
None of these is difficult to fix. All of them take longer than expected when found six weeks before an audit.
What to do next
Get your buyer's requirement in writing first: which report type, which systems, what deadline. Readiness scoped against the wrong boundary produces accurate findings about the wrong thing.
Our free readiness diagnostic gives an immediate first view, and the SOC 2 service page sets out how readiness and the wider programme run together.
References
FAQ
What is a SOC 2 readiness assessment?
A structured comparison of your current position against each criterion in scope, stating what is met, what is not, and what closes each gap.
Do I need readiness if I have a compliance platform?
The platform tells you which controls are missing. Readiness tells you what each gap means for your architecture, what evidence will satisfy an auditor, and in what order to fix things.
Can my auditor do the readiness assessment?
Not for their own examination. Independence prevents an accounting firm from advising you on how to pass an examination it will then perform.
How long does readiness take?
Usually two to four weeks for a company with a defined scope, including the delivery call.
What does readiness cost?
Typically $5,000 to $25,000, scaling with scope and system count rather than headcount.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. Our readiness and gap assessment is delivered as a fixed fee with a delivery call, and states findings requirement by requirement rather than issuing an opinion. We take companies through SOC 2, ISO 27001, ISO/IEC 42001 and the EU AI Act, and maintain the position afterwards. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.