SOC 2 Type I
SOC 2 Type I readiness: get your first report in hand
A SOC 2 Type I report shows that your security controls are designed correctly on a specific date. It is often the fastest way to answer a customer who needs proof of your security now.
Taskew gets you ready for the Type I audit. We set up Vanta, fix the gaps in your environment, write the policies and support you during fieldwork. The same controls then carry you into Type II.
SOC 2 Type I
What Type I readiness includes
Assessment
- Scoping of systems and Trust Services Criteria
- Vanta setup and integrations
- Gap assessment with a prioritized plan
Remediation
- AWS security configuration
- Identity, MFA and access control
- Logging, monitoring and alerting
- Backups and encryption
Program and audit
- Security policies tailored to your company
- System description support
- Evidence preparation
- Support during fieldwork
Process
How a Type I engagement runs
- Step 1
Scope
We agree on the systems, criteria and target audit date, and you get a fixed proposal.
- Step 2
Assess
We connect Vanta and map every failing test to an owner and a fix.
- Step 3
Fix
We remediate the technical controls and put the policies and procedures in place.
- Step 4
Audit
Your auditor tests the design of your controls on the audit date. We handle the technical questions.
About pricing: Every company's scope is different: how many systems are in scope, which Trust Services Criteria you need and how much is already in place. So we don't publish prices. After a discovery call and a short scoping review, you get a written proposal with a fixed scope.
FAQs
Common questions
What is a SOC 2 Type I report?
A SOC 2 Type I report is an independent auditor's opinion on whether your security controls are suitably designed at a single point in time. It does not test whether they worked over a period. That is what Type II does.
Will customers accept a SOC 2 Type I report?
Many will, especially for a first contract or a pilot. Larger enterprises usually ask for Type II eventually, so we set up your controls with Type II in mind from day one.
What happens after the Type I audit?
Most companies start their Type II observation period right away, using the same controls. Our managed compliance retainer keeps those controls passing during the observation period.
Related
Also from Taskew
SOC 2 Type II readiness
Run your controls through the observation period with evidence your auditor can test.
Learn moreManaged compliance on Vanta
A monthly retainer: when Vanta flags an issue in your environment, we fix it within the agreed SLA.
Learn moreAWS cloud design, migration and management
Built with SOC 2 controls from the start, then maintained for you.
Learn moreTell us what your customers are asking for
Pick a few times that work for you. We'll call to learn about your environment and timeline, then send a written proposal if we're a good fit.