Security / SOC 2
Get ready for
your SOC 2 audit.
Customers ask for SOC 2 before they buy. We design and implement the controls across the trust criteria and ready you for the audit.
Trusted & Backed by:
What it requires
What SOC 2
covers.
SOC 2 reports against the trust services criteria. Security is required; the rest are scoped to you.
Security
The common criteria, required in every SOC 2 report.
Availability
That your service is there when customers need it.
Confidentiality
That confidential data is protected.
Processing integrity
That processing is complete, valid and timely.
Privacy
That personal data is handled to the criteria.
Status
Type I, Type II, and the clock.
A Type II report covers controls over a period. Plan for the observation window.
Type I
Controls at a point in time
Type II
Controls over an observation period
3 to 12 months
Typical Type II observation window
CPA firm
Issues the report, not Kensara
We never promise a pass. The opinion is the independent auditor's. We make sure the controls are ready and the evidence is there.
How we get you there
From gap to
audit ready.
Scope and gap
We pick the criteria that fit your service and find the gaps.
Design the controls
Policies and controls across the chosen criteria, with evidence built in.
Operate them
Controls run on the platform so evidence accrues through the observation window.
Audit after audit
We keep the controls and evidence current for the next report.
Overlap
Already doing
ISO 27001?
Packages
One package,
every stage.
Readiness and Implementation get you to the audit. Sustain keeps you report ready for the next period.
See packagesIndependence
We prepare you and implement the controls. An independent CPA firm performs the examination and issues the SOC 2 report. Kensara does not issue SOC 2 reports and never promises a pass.
Resources
Start with a readiness checklist.
Questions
SOC 2, in your words.
Should we start with Type I or Type II?
Many start with Type I to show controls are in place, then run Type II over an observation period. We help you choose.
How long is the Type II window?
Commonly three to twelve months. Controls must operate through it, so we start evidence early.
Do you issue the SOC 2 report?
No. An independent CPA firm issues it. We prepare you and make sure the evidence is there. We never promise a pass.
Privacy. Security. Intelligence.
Built for trust.
Tell us what you need to prove. We reply within one working day.