SOC 2 compliance
SOC 2 readiness, done by the engineers who fix the gaps
Taskew gets SaaS companies ready for their SOC 2 Type I or Type II audit. We set up Vanta, fix the failing controls in your AWS environment, write the policies and support you through the audit. Then we can keep you compliant every month.
The basics
What is SOC 2?
SOC 2 is a security report for service companies, defined by the AICPA. An independent CPA firm tests your controls against the Trust Services Criteria and issues a report you can share with customers.
A Type I report checks that your controls are designed correctly on a single date. A Type II report checks that they actually worked over an observation period, usually 3 to 12 months. Most enterprise buyers ask for Type II.
Taskew is not an audit firm and does not issue SOC 2 reports. We do the work that gets you ready and keeps you ready, so the audit goes smoothly.
In 2026 we guided four companies through SOC 2: one Type I and three Type II, all on Vanta.
Not sure where you stand?
Take our free SOC 2 Type II readiness assessment. 32 questions, about 8 minutes, with your score right away.
Services
Pick where you are
SOC 2 Type I readiness
Design your controls, close the gaps and get audit-ready for a point-in-time report.
Learn moreSOC 2 Type II readiness
Run your controls through the observation period with evidence your auditor can test.
Learn moreManaged compliance on Vanta
A monthly retainer: when Vanta flags an issue in your environment, we fix it within the agreed SLA.
Learn moreWhat we cover
Technical controls and the people processes behind them
Auditors test more than your AWS settings. They check that people follow your processes and that the evidence is signed, dated and complete. We set up both, and check a sample before your auditor does.
- Cloud infrastructure
- Logging, encryption, backups, network security and vulnerability management in AWS.
- Identity and access
- Single sign-on, MFA, least-privilege roles and quarterly access reviews.
- Engineering process
- Code review, change management, deployment pipelines and incident response.
- People and HR
- Background checks, onboarding and offboarding, security training and signed, dated performance reviews.
- Vendors
- A vendor inventory, risk reviews and the security reports you collect from key suppliers.
- Policies
- Security policies written for how your company actually works, approved and acknowledged by your team.
Taskew is a Vanta MSP (managed service provider). You can get your Vanta subscription through us, or buy it directly from Vanta and give us access to your account.
Trust Services Criteria
The five areas a SOC 2 report can cover
Security is required. You add the others when your customers or contracts call for them. We help you decide during scoping.
- SecurityRequired
- Required in every SOC 2 report. Access control, change management, monitoring, incident response and more.
- Availability
- Uptime, backups, disaster recovery and capacity planning for the systems customers rely on.
- Confidentiality
- How you protect data customers mark as confidential, from encryption to deletion.
- Processing integrity
- Whether your system processes data completely, accurately and on time.
- Privacy
- How you collect, use, keep and dispose of personal information.
Our process
How we get you to a clean report
- Step 1
Discovery and scoping
We learn what your customers are asking for, which systems are in scope and which Trust Services Criteria you need. You get a written proposal with a fixed scope.
- Step 2
Gap assessment in Vanta
We connect Vanta to your AWS accounts, code repositories, identity provider and HR tools, then turn the failing tests into a prioritized remediation plan.
- Step 3
Remediation
We fix the gaps ourselves: IAM and MFA, logging, encryption, backups, vulnerability scanning, change management. We also write the policies and set up the people processes, like onboarding, training and performance reviews.
- Step 4
Audit support
You choose the audit firm. We prepare the evidence, answer technical questions during fieldwork and help close any requests until your report is issued.
- Step 5
Stay compliant
Type II tests your controls over months, and they must keep working after the report. Our managed compliance retainer keeps Vanta green between audits.
About pricing: Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope.
FAQs
SOC 2 questions we hear most
What does a SOC 2 readiness consultant do?
A SOC 2 readiness consultant gets your company prepared for the audit. At Taskew that means setting up Vanta, finding the control gaps, fixing them in your AWS environment, writing the required policies and supporting you while the auditor tests your controls.
Is SOC 2 a certification?
No. SOC 2 is an attestation report, not a certification. An independent CPA firm tests your controls and issues a report describing what it found. People often say "SOC 2 certified", but the accurate term is having a SOC 2 report.
Do we need SOC 2 Type I before Type II?
No, but it often helps. A Type I report gives you something to share with buyers sooner and confirms your controls are designed correctly before the Type II observation period starts. If your buyers will only accept Type II, you can go straight to it.
How long does SOC 2 take?
It depends on how much is already in place. Readiness work usually takes a few months. A Type II report also needs an observation period, typically 3 to 12 months, before the auditor can issue it. We give you a realistic timeline after scoping.
How much does SOC 2 compliance cost?
Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope. Your auditor's fee is separate. Your Vanta subscription can be bought through us, as your Vanta MSP, or directly from Vanta.
Do you only work with Vanta?
Yes. We focus on Vanta so we know its integrations, tests and evidence requirements in depth. Taskew is a Vanta MSP (managed service provider). You can get your Vanta subscription through us, or buy it directly from Vanta and give us access to your account.
Can we buy Vanta through Taskew?
Yes. As a Vanta MSP, we can provide your Vanta subscription as part of your engagement. If you already have Vanta, or would rather buy it yourself, you give us access to your account and we work in it with you.
Do you help with HR and policy controls, or only AWS?
Both. SOC 2 covers people and process controls as well as technical ones. We set up processes like onboarding, offboarding, security training and performance reviews, show your managers what auditors look for, and check a sample of the evidence before your auditor does.
Do you perform the SOC 2 audit?
No. Only a licensed CPA firm can perform a SOC 2 audit and issue the report. You choose the audit firm. We prepare you for it and work alongside them during fieldwork.
Can you fix the issues Vanta finds in our AWS account?
Yes, that is the core of what we do. We are engineers, so we change the configuration, deploy the tooling and write the documentation ourselves, rather than handing your team a list of findings.
Is a customer asking for your SOC 2 report?
Pick a few times that work for you. We'll call to learn about your environment and timeline, then send a written proposal if we're a good fit.