Technology and service companies
SOC 2 is not a badge you buy: it is a report on how your controls operated over a period. DM11 prepares your company to reach the audit with controls working and evidence ready, without discovering gaps once the auditor is already inside.
DM11 prepares your company. The SOC 2 report is issued by an independent CPA firm you contract directly, and whoever implements the controls is barred by independence from auditing the same client.
Who runs the preparation
Start with what almost everyone gets wrong
There is no SOC 2 certificate, no seal and no certification body. What exists is an attestation report, issued under the standards of the American Institute of Certified Public Accountants by a licensed CPA firm. Anyone selling a certificate is describing something that does not exist, and usually gets the rest wrong too.
The output is a document with five sections, among them the system description written by your own company and the auditor's test results control by control. Your customer will read it, especially the part listing exceptions. It is not a one-page PDF with a logo.
Consultancies do not issue SOC 2 reports, and neither do we. The audit firm is contracted separately, by you. More than that: whoever implemented the controls is barred by independence from auditing the same client. Be wary of anyone offering both.
The report most often requested does not assess how your company looks today: it assesses how it operated over months. Which means preparation does not end when a control is implemented, but when it has produced consistent evidence across the whole observation period.
The first decision
This choice sets cost, timeline and what you can actually show a customer. It is also where the market's most expensive misconception circulates.
Design of controls
Assesses whether controls are suitably designed and implemented on a given date. It is a snapshot. It demonstrates seriousness quickly and often unblocks a contract while Type II is still under way. It says nothing about controls having worked over time, and experienced buyers know that.
Design and operation
Assesses whether controls were suitably designed and operated effectively over a period. This is the report most corporate customers require. The period is agreed between you and the auditor, and the market tends to treat three months as the floor, with six to twelve most accepted by demanding buyers.
It is often claimed that Type I is a prerequisite for Type II. It is not. Your company can go straight to Type II, and many do, saving time and an entire project. Doing Type I first is a commercial decision, for when a contract is waiting and you cannot sit out the observation period. Anyone presenting Type I as mandatory is selling you an extra stage.
Scope
This is the project's biggest lever on cost and timeline, and almost no page in the market mentions it. Security, the common criteria, is mandatory in any SOC 2. The other four are elective, depending on what your customer requires and what your service commits to contractually.
| Category | Included? | When it makes sense |
|---|---|---|
| Security | Mandatory | The common criteria, organised into nine groups running from the control environment to vendor management. It is the backbone of any SOC 2 report, and on its own already satisfies much of what customers ask for. |
| Availability | Optional | When you commit to availability contractually. Covers capacity, recovery and plan testing. In practice near-mandatory for anyone selling software as a service with a service level agreement. |
| Confidentiality | Optional | When you handle information the customer classifies as confidential and expects to see protected by agreement. Covers identification and disposal of that information. |
| Processing integrity | Optional | When your service processes transactions or calculations on the customer's behalf and the output must be complete, accurate and authorised. Common in payments, payroll, billing and logistics. |
| Privacy | Optional | When you process personal data and the customer wants it covered. Note: it covers a subset of what privacy law requires, and does not replace a privacy programme. |
Including a category nobody asked for is the most common way to inflate a SOC 2 project with no commercial gain. Before defining scope, it pays to ask your customer in writing which report they expect and with which categories.
The real timeline
Nobody publishes the summed timeline, which is why so many promise impossible dates. The phases below run in sequence, and the sum is what matters when a contract is waiting.
Assessment against the criteria, definition of categories, systems and environments, and the choice between Type I and Type II. Ends with a plan and the scope in writing.
The most variable phase, and the biggest schedule risk. It depends entirely on what already exists. A company with governance in place moves fast; one that never formalised anything has foundation work to do.
Exists only in Type II, and it is calendar time that cannot be compressed. Controls have to operate and produce evidence across the whole period agreed with the auditor.
The CPA firm tests controls, examines evidence and conducts interviews. This is where the gap between the written process and the practised one appears.
Drafting, management's response to any exceptions, and issuance. The document comes out in English when the firm is American, which is usually the case.
We do not publish a standard timeline because it would be guesswork: remediation varies enormously between companies and the observation period is a scoping choice. What can be said with confidence is that a Type II does not come out in weeks, and that anyone promising that is describing something else. After the diagnosis, we can put dates on your case.
Who does what
In this market people promise a certificate that does not exist and sell an audit that whoever implemented the controls cannot perform. We would rather be clear from the start about who signs what.
Self-assessment
Eighteen questions across the control categories the report examines. The full result appears on screen, with a score per category and what closes the most critical gaps. We do not ask for your email to show it.
The report starts with the control environment, where the audit tests culture through documents.
How we run it
Every phase ends with a deliverable. You know what you get before you start.
We translate your customer's requirement into report type, categories, systems and period. This decision moves cost and timeline most, and is the one most often rushed.
You get
We assess your current position control by control, using the same checklist we use in audit work, showing real distance rather than an impression.
You get
We implement what is missing alongside your team: policies, access processes, change management, monitoring, incident response and vendor management.
You get
In Type II the auditor tests the whole period, so evidence has to come out of the operation. We define what is produced, by whom and how often, before the period starts.
You get
We support drafting the section of the report that is your company's responsibility, including system boundaries, commitments made and the treatment of subservice organisations.
You get
We simulate the audit with the auditor's rigour before they arrive, and support the CPA firm's fieldwork, including management's response if there are exceptions.
You get
Stories
We anonymise our clients with the same confidentiality that will protect your company later. The names change, and the pattern of the problems repeats.
Scoping
Twelve questions about what determines the size of a SOC 2 project. At the end you review your answers, correct anything you want, and receive a proposal built on that, without a meeting just to discover the basics.
If the request does not specify, it is worth confirming before pricing.
Frequently asked
Answers anchored in AICPA standards. Where no official figure exists, we say so.
No. It is an attestation report issued under the standards of the American Institute of Certified Public Accountants. There is no certificate, no seal and no certification body. The distinction is not pedantry: those who treat SOC 2 as a certification usually get the timeline, the scope and who can issue the document wrong too. If you find someone offering a SOC 2 certificate, the rest of the proposal deserves scrutiny.
More questions? Talk to DM11
A thirty minute conversation is usually enough to settle report type, categories and an order of magnitude for effort. No obligation.