Identity, Security & Compliance
SOC 2 readiness assessment.
Real controls, ready for your auditor.
A customer asked for your SOC 2 report and you do not have one yet. We scope it, find the gaps, build the technical controls in Microsoft 365, Entra ID, Intune and the rest of your stack, and help organize the evidence. Your CPA firm issues the report.
A SOC 2 readiness assessment prepares an organization for its SOC 2 examination before the auditor arrives. Pro IT NW, a Seattle-based, labor-only consultancy, scopes the system, assesses gaps against the criteria, implements technical controls in Microsoft 365, Entra ID, Intune and the rest of the stack, and helps prepare evidence. It is for service companies whose customers want a SOC 2 report. We never issue that report.
Who issues a SOC 2 report?
Only an independent CPA firm. The AICPA describes its SOC reports as "a suite of service offerings CPAs may provide". A SOC 2 examination looks at controls relevant to security, availability, processing integrity, confidentiality or privacy, measured against the AICPA's Trust Services Criteria. Readiness work happens before that: the auditor tests what exists, so the controls have to be real and running first. We do the readiness work. You choose and engage the CPA firm, and their opinion is theirs alone.
What does SOC 2 readiness include?
Scoping, a gap assessment, and the technical work to close the gaps.
- Scoping: which services, systems, people and vendors fall inside the report
- Gap assessment against the criteria you and your CPA firm select
- Identity and access in Entra ID: MFA, Conditional Access, admin roles, onboarding and offboarding
- Devices in Intune: enrollment, encryption, patching and compliance policies
- Microsoft 365: sharing, retention, audit logging and alerting
- The rest of the stack: cloud hosting, code repositories, backups and business apps in scope
- Policies written to match the controls you actually run, not a template you cannot follow
- Evidence preparation: what the auditor will ask for and where each item comes from
How does a readiness engagement run?
Five steps, each with a written output.
- Scope. A call about your services and what customers are asking for, then a written scope and fixed price.
- Gap assessment. Each relevant criterion compared with what is configured and practiced today.
- Plan. Gaps ranked by effort and importance, with owners on your side and ours.
- Implement. We configure the technical controls and draft policies that describe them accurately.
- Evidence. We help organize the records so your team can answer the auditor without a scramble.
What do you get at the end?
A system ready to be examined, and the paperwork to show it.
- A written scope and system description draft
- A gap assessment and remediation plan
- Controls configured in your own tenant and tools, documented as built
- Policies that match those controls
- An evidence map your team can maintain after we leave
- Training for your internal IT staff on running the controls day to day
What is this not, and who is it for?
It is readiness work, sold as readiness.
- Not a SOC 2 report, audit opinion or attestation, and never a promise you will pass
- Not legal advice
- Not a resale channel: we sell no compliance platform or software
- For SaaS companies and service firms facing a SOC 2 request in a sales or renewal
- For founders, COOs and CFOs who need a plain plan, and IT leads who need the controls built right
Related
Much of SOC 2 is identity: see Entra ID and hybrid identity and Microsoft Purview data governance. If staff use AI tools with customer data, an AI usage review belongs in scope. For broader security direction, see our virtual CISO engagement, and for everything else, Identity, Security & Compliance.
FAQ
Common questions about SOC 2 readiness.
What is a SOC 2 readiness assessment?
A SOC 2 readiness assessment is preparation done before a SOC 2 examination. It defines which systems and services are in scope, compares the controls you actually run against the criteria the auditor will test, and lists the gaps to close first. Pro IT NW then helps implement the technical controls and organize the evidence, so the organization goes into the examination knowing where it stands.
Can Pro IT NW make us SOC 2 compliant or issue our SOC 2 report?
No. A SOC 2 report is issued only by an independent CPA firm, which examines your controls and gives its own opinion. Pro IT NW does the readiness and implementation work beforehand. We do not issue reports, attest to controls, or tell you that you will pass, and we are not your auditor.
Is SOC 2 readiness work legal advice?
No. It is operational and technical work: scoping, gap assessment, configuring controls and preparing evidence. It is not legal advice and not an audit opinion. Contract terms with your customers, and any legal reading of what they require, belong with your counsel.
Which technical controls do you implement?
Commonly: identity and access in Entra ID (MFA, Conditional Access, admin roles, joiner and leaver processes), device management and encryption in Intune, Microsoft 365 sharing, retention and audit logging, Defender coverage, backup and restore testing, and access reviews. The same work extends to the rest of your stack, such as cloud hosting, code repositories and line-of-business apps, wherever those systems fall in scope.
Do we need to buy a compliance automation platform first?
No. Some organizations use one to collect evidence, but readiness work does not depend on one. Pro IT NW is vendor-neutral and resells nothing, so we work with whatever platform you already have or choose, or with plain, well-organized documentation if you have none.
How is it priced?
It is scoped and priced up front after a call about your services, systems, headcount and what your customers are asking for. Control implementation is quoted against the gaps the assessment finds. There is no hourly meter.
Free checks
Not ready to talk yet? Start with one of these.
10 questions
Could you take back the keys?
Ten yes / no questions: could you remove your IT provider's access without their help and keep control? Admin accounts, domain, licenses, backups, contract dates.
Open →
Runs in your browser
Who controls your domain?
See who runs your domain's DNS, where your email goes, whether you publish DMARC, and whether on-prem Exchange is still visible. Nothing stored.
Open →
Sample report
See a Copilot readiness report
A sanitized sample assessment: findings scorecard, readiness ratings and remediation roadmap, so you can see what you would get.
Open →
Get ready for the SOC 2 request on your desk.
Tell us what you sell, which systems run it, and who is asking for the report. We'll come back with a written scope and a fixed price.