Service organization assurance

SOC 2 readiness for service organizations

Build an examinable control environment for the service you actually deliver. We help technology teams define the system, operate controls, and prepare evidence for an independent CPA examination.

Our implementation focus

Make the requirements operational.

  1. 01

    Define the system boundary and reporting goals

  2. 02

    Map risks to applicable Trust Services Criteria

  3. 03

    Implement and assign control owners

  4. 04

    Establish evidence collection and exception handling

  5. 05

    Prepare the system description and auditor handoff

Independent assessment

SOC 2 produces an independent attestation report, not a certification. A licensed CPA firm performs the examination.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 04

Scope the report

Confirm the service, system boundary, intended users, Trust Services Criteria, and reporting objective.

Output: System boundary and readiness plan
02 / 04

Design the controls

Translate risks into owned, testable procedures across people, infrastructure, software, data, and suppliers.

Output: Control matrix with owners and frequencies
03 / 04

Operate and test

Run controls, collect normal-course evidence, inspect exceptions, and correct weak processes before examination.

Output: Evidence calendar and remediation record
04 / 04

Prepare the handoff

Assemble the system description, evidence index, and management responses for the independent examiner.

Output: Examiner-ready documentation

Questions we hear

Get the distinctions right.

Is SOC 2 a certification?

No. SOC 2 is an attestation examination performed by an independent licensed CPA firm. The outcome is a report on a described system and its controls.

Can a company outside the United States pursue SOC 2?

Yes. The decision is usually driven by customer assurance needs rather than the company’s home country. Reporting scope and criteria should reflect the actual service and its users.

How does SOC 2 relate to ISO/IEC 27001?

The same operating controls can support both efforts, but the outcomes differ: SOC 2 is a report on a service organization system; ISO/IEC 27001 sets requirements for an information security management system.

Market context

The same standard, different buyer questions.

EuropeA practical route to SOC 2 customer assurance and ISO/IEC 42001 AI governance for European technology teams, with ISO/IEC 27001 as a security foundation.AustraliaHow Australian SaaS and service organizations can approach SOC 2, ISO/IEC 42001, and ISO/IEC 27001 alongside local security and privacy expectations.SingaporeA practical assurance and AI governance path for Singapore-based technology and service organizations serving regional and international customers.

Practical guidance

Read the next decision.

Market guide4 min read

SOC 2

SOC 2 for European SaaS companies: when it helps and how to prepare

A buyer-led guide to SOC 2 in Europe: the right trigger, a defensible scope, and how it sits beside ISO 27001 and GDPR.

Read resource
Buyer question4 min read

SOC 2

Which SOC 2 Trust Services Criteria should a provider include?

Choose reporting criteria based on the service and buyer concern rather than adding categories for appearance.

Read resource
Market guide5 min read

SOC 2

Answering a SOC 2 request from a US buyer when your team is in Europe or APAC

Turn a cross-border procurement request into a scoped assurance plan without claiming SOC 2 is a local legal requirement.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation