Questions about SOC 2, Vanta and AWS

A SOC 2 readiness consultant gets your company prepared for the audit. At Taskew that means setting up Vanta, finding the control gaps, fixing them in your AWS environment, writing the required policies and supporting you while the auditor tests your controls.

No. SOC 2 is an attestation report, not a certification. An independent CPA firm tests your controls and issues a report describing what it found. People often say "SOC 2 certified", but the accurate term is having a SOC 2 report.

No, but it often helps. A Type I report gives you something to share with buyers sooner and confirms your controls are designed correctly before the Type II observation period starts. If your buyers will only accept Type II, you can go straight to it.

It depends on how much is already in place. Readiness work usually takes a few months. A Type II report also needs an observation period, typically 3 to 12 months, before the auditor can issue it. We give you a realistic timeline after scoping.

Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope. Your auditor's fee is separate. Your Vanta subscription can be bought through us, as your Vanta MSP, or directly from Vanta.

Yes. We focus on Vanta so we know its integrations, tests and evidence requirements in depth. Taskew is a Vanta MSP (managed service provider). You can get your Vanta subscription through us, or buy it directly from Vanta and give us access to your account.

Yes. As a Vanta MSP, we can provide your Vanta subscription as part of your engagement. If you already have Vanta, or would rather buy it yourself, you give us access to your account and we work in it with you.

Both. SOC 2 covers people and process controls as well as technical ones. We set up processes like onboarding, offboarding, security training and performance reviews, show your managers what auditors look for, and check a sample of the evidence before your auditor does.

No. Only a licensed CPA firm can perform a SOC 2 audit and issue the report. You choose the audit firm. We prepare you for it and work alongside them during fieldwork.

Yes, that is the core of what we do. We are engineers, so we change the configuration, deploy the tooling and write the documentation ourselves, rather than handing your team a list of findings.

A SOC 2 Type I report is an independent auditor's opinion on whether your security controls are suitably designed at a single point in time. It does not test whether they worked over a period. That is what Type II does.

Many will, especially for a first contract or a pilot. Larger enterprises usually ask for Type II eventually, so we set up your controls with Type II in mind from day one.

Most companies start their Type II observation period right away, using the same controls. Our managed compliance retainer keeps those controls passing during the observation period.

Type I checks that your controls are designed correctly on one date. Type II checks that they operated effectively over an observation period, usually 3 to 12 months. Type II takes longer but carries more weight with enterprise buyers.

Usually 3 to 12 months. First-time reports often use a shorter window so you get a report sooner. Later reports usually cover a full year. You and your auditor agree on the period.

In our experience, they are usually recurring tasks that happened but weren't documented: access reviews, offboarding, security training, performance reviews missing a signature or date, and vulnerability fixes past their deadline. We check a sample of that evidence before the auditor does.

Most companies get a new Type II report every year, because customers want a report that covers a recent period. That means your controls need to keep running between audits.

Managed SOC 2 compliance means an outside team keeps your controls working between audits. With Taskew, that means we fix the vulnerabilities and failing tests Vanta finds in your environment, within an agreed SLA, and keep the recurring evidence up to date.

No. If you already have a SOC 2 report and use Vanta, you give us access to your account and we start with a review of your current findings. If you don't have Vanta yet, you can get it through us.

Response times are set in your agreement, based on the severity of each finding and the size of your environment. We agree on them before we start.

A SOC 2 readiness assessment checks your current security controls against what a SOC 2 auditor will test, so you can find and fix gaps before the audit. Ours is a free self-assessment focused on SOC 2 Type II.

Each of the 32 controls is weighted by how closely auditors test it and how often it causes exceptions. Yes earns full credit, Partly earns half, and No or Not sure earn none. The score is the share of the total weight you earn.

No. It's a self-assessment to help you plan. Only an independent CPA firm can perform a SOC 2 audit and issue a report, and the score doesn't predict an auditor's opinion.

Your answers are saved only in your browser so you can come back to them. If you ask for the full report, we email it to you and send a copy to our team so we can follow up. We don't sell your information.

It covers the Security criteria every SOC 2 report includes (CC1 to CC9), plus availability basics (A1), across policies and people, risk and vendors, access control, data protection, monitoring and incidents, change management, availability and Type II evidence.

Yes. Most of our cloud clients keep us on after the move to handle monitoring, patching, backups, security fixes and changes. You get one team that knows your environment.

We plan migrations to keep downtime as short as possible, often a few minutes at cutover, and we schedule it for a quiet time. We test the new environment before switching any traffic.

We build with SOC 2 controls in mind: CloudTrail logging, encryption at rest and in transit, least-privilege IAM, MFA, backups and monitoring. That makes a later audit much easier.

It depends on what the application needs to do. Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope.

Ownership is set out in your contract. Talk to us about your requirements on the discovery call.

Yes. We host them on AWS and handle updates, security fixes and new features after launch.

Answer engine optimization means structuring your website so AI tools like ChatGPT, Claude, Perplexity and Google's AI answers can understand your business and cite it. It builds on SEO with clear answers, consistent facts and structured data.

Yes. We host them on AWS with Amazon S3 and CloudFront, and handle updates, security and backups as part of ongoing maintenance.

Yes. We redesign and rebuild existing sites, keep your old links working with redirects so you don't lose search rankings, and move hosting to AWS if you'd like.

Request a discovery call through our contact form and tell us when you're free. We'll email you a code to confirm your address. We'll call you at one of those times to learn what you need. If it's a good fit, we'll set up a Microsoft Teams meeting to scope the work. You can also call 240-457-6035.

Monday to Friday, 9 am to 5 pm Eastern. We don't do project work on weekends, but you can schedule a discovery call on a Saturday.

Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope.

A small US-based team of 3 to 5 engineers, led by founder Godfrey T., an AWS Solutions Architect. You talk to the people doing the work.

Our client engagements are under NDA, so we don't publish client names. We describe our work by type and industry, and we can talk through relevant experience on a discovery call.

Submit a ticket in the client portal at app.taskew.com/external_tickets or email support@taskew.com.