Your enterprise customers require SOC 2. You need to know where you stand.

Our gap analysis typically takes 2-3 weeks: Week 1 for scope definition and framework selection, Week 2 for documentation review against SOC 2 requirements, and Week 3 for situation appraisal and reporting. The timeline can vary based on your organization's size and complexity, but we'll give you clear deadlines upfront so you know when you'll have audit readiness clarity.

Type I is a point-in-time assessment: 'Your controls were in place on October 15, 2025.' It's faster and less expensive, but less valuable to enterprise customers who want ongoing assurance. Type II requires operating controls for a minimum period (typically 3-6 months) to demonstrate they work consistently over time. Most enterprise customers require Type II. Our gap analysis helps you understand readiness for both, so you can make an informed decision about which audit type aligns with your customer requirements.

Audit firms often offer gap analysis to win your audit business. There's a conflict of interest—they benefit from finding more gaps (more remediation work, longer audit engagement). We're independent. Our gap analysis gives you objective evidence about your readiness, not a sales pitch. You get an honest assessment that helps you decide whether you're ready for audit now, need remediation first, or should consider alternatives—without pressure to commit to an audit.

Different audiences require different certifications. ISO 27001 is recognized internationally and valuable for European markets. SOC 2 is what US enterprises require—especially in their vendor risk management programs. Many companies have both. Our gap analysis shows you where your ISO 27001 controls already meet SOC 2 requirements (significant overlap) and what additional controls you need specifically for SOC 2. This helps you understand the real effort required to add SOC 2 to your existing compliance program.

That's exactly why you do a gap analysis—to know before you invest. If there are major gaps, you'll get a prioritized roadmap showing what to fix first based on audit readiness impact, realistic timelines (3 months vs. 18 months), and effort estimates. Some gaps are quick wins (documentation updates), others take longer (new control implementation). The gap analysis helps you make an informed decision: fix gaps now and proceed to audit, improve maturity first, or understand the timeline before committing to an audit engagement.

Type I: Immediately after gaps are fixed (point-in-time assessment). Type II: You need to operate controls for a minimum period (typically 3-6 months) to demonstrate they work consistently over time. The gap analysis shows you which gaps block audit readiness immediately and which can be addressed during the observation period. This helps you understand your actual timeline to audit readiness—not just remediation time, but the full path to certification.

Minor findings can usually be remediated and the auditor re-tests. Major findings might require completing the audit period again (for Type II). The gap analysis helps prevent this by identifying critical gaps before you commit to an audit. You'll know your readiness level, understand what needs to be fixed first, and have a prioritized remediation plan. This reduces audit risk and helps you enter the audit with confidence rather than uncertainty.

Not necessarily. You need someone to coordinate SOC 2 preparation, but many companies handle it with existing security/IT team plus external preparation help. Ongoing maintenance (after certification) is typically 10-20% of a full-time role. The gap analysis helps you understand the real effort required—both for initial preparation and ongoing maintenance—so you can make informed decisions about resource allocation and whether you need additional headcount.

Yes, that's a separate engagement. Many clients follow this path: gap analysis → remediation (with or without our help) → audit preparation support → independent audit. After the gap analysis, you'll have a clear picture of what needs to be done. If you want us to handle remediation and audit preparation, we can start immediately—no need to repeat the assessment. The gap analysis becomes your roadmap for the entire journey to SOC 2 certification.