Solutions · SOC 2 Readiness
SOC 2, from readiness to report.
SOC 2 is an attestation report issued by a licensed CPA firm — often called SOC 2 certification. We take you the whole way: scoping, controls and evidence with our team, then an independent examination by a licensed CPA firm.
The problem
Enterprise buyers ask for SOC 2 before they will sign.
Teams start the audit before the controls and evidence exist, then pay twice for the same work.
How Risknox solves it
Platform and people, doing different halves of the job.
Platform
Fortress runs the Trust Services Criteria assessment, the control set and the evidence library, with an owner and a date against every criterion.
People
Our team writes the policies and closes the controls with you, then coordinates the examination with an independent licensed CPA firm, which audits and issues the report.
What you get
- Scope and gap assessment against the Trust Services Criteria
- Policies and controls remediated with our team
- Evidence collected in Fortress across the observation window
- Type I and Type II examinations by a licensed CPA firm
- The report issued by that firm, plus continuous monitoring for the next cycle
How it works
- 1
Scope and gap assessment
We agree the Trust Services Criteria and the system boundary, then assess controls against them and rate the gaps in Fortress.
- 2
Remediation, policies and controls
Our team writes the policies and designs the controls with you, giving every gap an owner and a due date.
- 3
Evidence collection in Fortress
Evidence is collected across the observation window, versioned and mapped to each criterion as the window runs.
- 4
Independent examination by a licensed CPA firm
Type I first, then Type II. The examination is performed by a licensed CPA firm, not by us.
- 5
Report issued by the CPA firm, and continuous monitoring
The firm issues the report for your buyers, and monitoring continues so the next cycle starts from a live control set.
Products in this solution
Go deeper
Questions we get asked
Who issues the SOC 2 report?+
A licensed CPA firm performs the examination and issues the report. Risknox runs scoping, remediation and evidence collection in Fortress.
Is SOC 2 a certification?+
SOC 2 is an attestation report issued by a licensed CPA firm — often called SOC 2 certification. There is no certificate: the report states the auditor’s opinion on the controls described for the period covered.
Type I or Type II?+
Both, and most clients take Type I first. Type I reports on the suitability of controls at a point in time; Type II reports on operating effectiveness across the observation window, which is why evidence is collected as the window runs.
How long does it take?+
Scope, the criteria selected, the observation window and audit availability all move the date. You get a written plan with dates before the examination starts.
Can we reuse evidence we already have?+
Yes. Fortress maps what exists before requesting anything new, so existing policies, tickets and screenshots count.
Get a SOC 2 quote
No obligation. If it is not the right fit, we will say so.