by Assurion Services | Sep 2, 2026 | SOC 2
If your platform runs on a cloud provider, uses a managed data centre, or hands part of the service to a specialist partner, your SOC report has to say something about them. You have two options for how. The carve-out method names the vendor, describes what you rely...
by Assurion Services | Sep 2, 2026 | Compliance Readiness
The single biggest driver of a painful SOC 2 fieldwork is not the number of controls. It is whether the evidence already exists in a form the auditor can use, or whether your team has to go and manufacture it after the period has closed. Reconstructed SOC 2 evidence...
by Assurion Services | Aug 26, 2026 | SOC 1
If an email lands from your customer’s external auditor asking for your SOC 1 report, something specific has happened: they have concluded that your service is part of their client’s internal control over financial reporting, and they cannot audit what...
by Assurion Services | Aug 24, 2026 | Compliance Readiness
If you are starting from nothing and your buyer wants a Type 2, plan on somewhere between six months and a year from the day you start to the day you hand over a report. If they will accept a Type 1, you can often get there in two to four months. Those ranges are wide...
by Assurion Services | Aug 24, 2026 | Compliance Readiness
A SOC 2 readiness assessment is a structured comparison between the trust services criteria that apply to you and what your organization actually does today. The deliverable is a gap list: here are the criteria, here is what you have, here is what is missing, here is...
