SOC 2 Type 2 readiness and attestation support.
AICPA Trust Services Criteria — security, availability, confidentiality, processing integrity and privacy. Delivered in partnership with an AICPA-licensed CPA firm.
What we mean by SOC 2
SOC 2 is the AICPA’s assurance framework for service organisations. A SOC 2 attestation reports on whether controls at the service organisation meet the AICPA Trust Services Criteria. Two report types exist: Type 1 (point-in-time, control design) and Type 2 (operating period, control design and operating effectiveness).
Enterprise buyers almost always ask for Type 2 because it evidences operation, not just design. The Trust Services Criteria cover five domains — Security (required), Availability, Confidentiality, Processing Integrity and Privacy. Only AICPA-licensed CPA firms can issue the attestation report; we deliver the readiness, control design and evidence work, and partner with a licensed CPA firm for the attestation itself.
Key facts
- Report focus
- Type 2
- Trust Services Criteria
- 5
- Typical remediation
- 6–12 mo
- Issuing standard
- AICPA
What we cover
Four work streams that take an organisation from readiness assessment through clean attestation.
Readiness assessment & gap analysis
Map current controls to the Trust Services Criteria you intend to include in scope. Identify gaps that would prevent a clean attestation, with a remediation plan that fits your engineering and policy roadmap.
Control design & remediation support
Design controls that satisfy the criteria without over-engineering them. Most organisations already have most of what they need; the work is structuring it as evidence rather than rebuilding it from scratch.
Evidence collection & continuous monitoring readiness
Set up the evidence pipeline the audit will rely on — system descriptions, control owners, monitoring outputs, exception logs. Continuous-monitoring readiness is what makes Type 2 attainable rather than a fire-drill.
Attestation engagement support
Liaise with the AICPA-licensed CPA partner through the audit window — evidence handover, control walkthroughs, exception handling, management response drafting. We sit on your side of the table.
How an engagement runs
Four stages, end-to-end. The remediation period is the longest because Type 2 reports require evidence of operating effectiveness over a period — that period is the work, not a wait.
- 1
Scoping & Trust Services Criteria selection
1–2 weeksDecide which TSCs are in scope (Security is required; Availability, Confidentiality, Processing Integrity and Privacy are optional). Define the system boundary, the in-scope sub-services, and the operating period for the Type 2 window.
- 2
Readiness assessment
4–8 weeksWalk through every applicable AICPA Trust Services Criterion against current control documentation, observation, and evidence. Output is a gap report with prioritised remediation actions and an honest readiness rating.
- 3
Remediation period
Typically 6–12 monthsClose the gaps and operate the controls. Type 2 reports require evidence of operating effectiveness over the period, so this stage is doing the work — not just designing it. We support cadence reviews, evidence sampling, and pre-audit dry runs.
- 4
Audit window with the CPA partner
4–8 weeksThe AICPA-licensed CPA partner runs the attestation. We support the engagement end-to-end: evidence handover, control walkthroughs, exception handling, and management response drafting. The CPA issues the attestation report.
Compliance contexts we cover
Three patterns we see most often. Each maps to a customer-driven need rather than a generic SOC 2 sales pitch.
SaaS / cloud service providers
The most common SOC 2 buyer. Enterprise customers ask for the report as part of their vendor-risk programme; an attestation often unblocks deals that an unaudited security posture cannot.
Data processors with US enterprise customers
UK and EU service providers selling into US enterprises increasingly need a SOC 2 Type 2 report alongside ISO 27001. We deliver both as a single mapped programme where it makes sense.
Co-delivery with ISO 27001
SOC 2 controls map cleanly to ISO/IEC 27001:2022 Annex A — most organisations running ISO 27001 already have 70-80% of what SOC 2 needs. We design programmes that satisfy both with one set of controls and one evidence pipeline. See our /services/iso-27001 service for the ISO side.
Why 1 Sequence Cyber
Independent
No reseller relationships. No incentives to recommend a particular CPA partner over another. Our job is to get you to a clean attestation; the CPA partner issues it. The two roles are deliberately separated.
Practitioner-led
ISO 27001 lead auditors and PCI QSAs cross-trained on SOC 2 Trust Services Criteria mapping. The named consultant on the engagement is the consultant who shows up at every walkthrough and every evidence review.
Multi-discipline
SOC 2 sits alongside our PCI DSS, ISO 27001, GRC and vCISO practices. When a SOC 2 control overlaps with a PCI DSS or ISO 27001 control, we design once and use the same evidence — not parallel control sets that drift apart.
Ready to scope a SOC 2 engagement?
Tell us which Trust Services Criteria your customers are asking about and what your current control posture looks like. We’ll come back with a written readiness plan and a fixed-fee proposal for the consultancy work.
Back to all services.