Founding-customer offer:25% off your first year on annual plans confirmed before 31 March 2027.Talk to us
SOC 2
Get ready for your SOC 2 audit.
Fortress gets you audit-ready. The SOC 2 report itself is issued by a licensed CPA firm.
Talk to a specialist first — we set up your workspace with you.
Or try the free risk checkWhat you have to do
What a SOC 2 examination actually asks of you.
- 01
Select the Trust Services Criteria: Security, plus Availability, Processing Integrity, Confidentiality or Privacy if your customers need them.
AICPA TSC - 02
Define the system boundary and write the system description.
AICPA TSC - 03
Design and operate controls that meet each selected criterion.
AICPA TSC - 04
Collect evidence across the observation window, not on the day of the audit.
AICPA TSC
Source: AICPA Trust Services Criteria — see /frameworks/soc-2 for the full list of requirements.
How Risknox handles it
Fortress runs readiness, controls and evidence in one place.
Compliance programs
The Trust Services Criteria as a program, with controls and readiness tracked by criterion.
Evidence and workpapers
Evidence collected across the observation window and filed against each control.
Audits
Planning, fieldwork, workpapers, findings and reports.
Audit workspace
An audit run end to end in one workspace.
What it costs
Talk to us for pricing.
Pricing depends on the criteria you scope and the number of seats. The CPA firm’s examination fee is separate and quoted by the firm.
Book a 20-minute walkthroughBook a walkthrough
Twenty minutes on your SOC 2 timeline.
We look at the criteria your customers are asking for, the evidence you already hold, and the gap to a clean observation window.
Questions we get asked
Who issues the SOC 2 report?+
An independent licensed CPA firm. Risknox runs readiness, controls and evidence collection in Fortress; the examination and the report belong to the CPA firm.
What is the difference between SOC 2 Type I and Type II?+
Type I reports on the suitability of controls at a point in time. Type II reports on their operating effectiveness over a period, so it takes longer and needs evidence collected as you go.
How long does SOC 2 take?+
Readiness usually runs six to ten weeks. The observation window is agreed with the auditor and your customer, commonly three to twelve months for Type II.
Does Fortress issue the report?+
No. Fortress produces the system description, the control set and the evidence. The examination and the report are the licensed CPA firm’s work, and the report is shared under NDA by you.