Skip to content
Security & Compliance Fixed scope

SOC 2 Evidence Groundwork

We put in place the technical controls and evidence collection a SOC 2 Type II audit expects, before your observation window opens.

Timeline
30 working days
Price
₹44,999 incl. GST
Reference
NP-SEC-103
Ownership
Delivered into accounts you own

Overview

What this engagement is

A SOC 2 audit is won or lost on evidence. Auditors expect proof, sustained over months, that access was reviewed, changes were approved, backups were restored and logs were kept. Assembling that retrospectively once the window has opened is slow and stressful. We build the technical controls up front, including automated access reviews, change management through pull requests, centralised logging with defined retention and vulnerability management tied to SLAs, and automate evidence capture wherever possible so nobody is hunting for screenshots the week before fieldwork.

Deliverables

What you receive

7 items
  • Control gap assessment against the Trust Services Criteria in your scope
  • Automated access review process generating quarterly evidence
  • Change management enforced via pull request approvals with a full audit trail
  • Centralised logging with retention aligned to audit expectations
  • Vulnerability management workflow with SLAs by severity
  • Tested backup, restore and disaster recovery procedures with documented evidence
  • Evidence collection runbook mapped to each control

Outcomes

What changes once it ships

Evidence gathers automatically instead of being pieced together later

Your observation window opens with controls already running

Fewer audit exceptions, which tends to mean a quicker, less costly audit

Process

How the 4 stages run

  1. Assess

    Your existing controls compared against the criteria in scope

  2. Implement

    Technical controls built and connected to the tools you already use

  3. Automate

    Evidence capture scheduled so it builds up without manual effort

  4. Rehearse

    A mock evidence request run exactly as an auditor would issue it

A strong fit for

  • Organisations whose enterprise deals are held up by security questionnaires
  • Startups about to begin a SOC 2 Type II observation window
  • Teams with a compliance platform in place but no engineers to implement controls

What we need from you

  • Administrative access to your cloud, identity provider and code repositories
  • A named compliance owner within your organisation
  • Details of your chosen auditor or compliance platform, if already selected

You share these through the brief that opens in your client dashboard once payment is confirmed. The timeline starts when they arrive.

Answers

Questions about this engagement

No. The audit must be performed by a licensed CPA firm. We prepare you and collaborate with whichever auditor you appoint.
The technical controls overlap substantially. ISO 27001 additionally requires an ISMS and management system documentation, which we scope separately.
Type II requires an observation window of three to twelve months once controls are operating. This work shortens the preparation, not the window itself.

This is a digital service — nothing is shipped. Work is delivered to the timeline above, into systems you control, and our refund terms explain what happens if a date is missed.

Often paired with

Engagements that work well alongside.

All Security & Compliance

Web Application VAPT

A hands-on penetration test of your web application, with proof-of-concept evidence for every finding and a retest once fixes land.

Hands-on penetration test of authentication, authorisation and business logic

₹29,999

12 working days · GST incl.

Add

Cloud IAM Permissions Audit

Each identity in your cloud account is checked against the access it really uses, and excess permissions are reduced safely.

Inventory of every user, role, service account and access key

₹18,999

10 working days · GST incl.

Add

GST included

₹44,999

Add Buy now