Help centre
Your Responsibilities in a SOC 2 Readiness Engagement
In a SOC 2 readiness engagement with SecureRoot, your team decides the scope, names an owner for every control, gives access to the systems evidence comes from, runs the controls and approves the policies. Your management owns the system description and signs the assertion, and you choose and contract the CPA firm that issues the report. SecureRoot scopes, assesses, designs, sets up evidence collection and supports you through fieldwork, but cannot run your controls or produce operating evidence for you.
About this help article
Written by SecureRoot Risk Advisory LLP.
Before work starts
Name one sponsor and one coordinator
Readiness moves at the speed your people answer. Name an executive sponsor who can approve policies and sign the assertion, and one coordinator who books interviews, chases evidence and is SecureRoot's day-to-day contact. Without both, decisions wait.
Phase by phase
What we need from you in each phase
- 01
Scoping and criteria selection
Bring the customer contracts and security questionnaires that started this, and say which products, environments and teams the report should cover. You decide, with our recommendation, which Trust Services Criteria to include and whether to aim for a Type 1 or a Type 2. SecureRoot introduces partner CPA firms at this stage; you choose one and contract with it directly.
- 02
Gap assessment
Make your engineering, HR and IT control owners available for interviews, and show us how controls run today, not how the policy says they should. Honest answers here produce a gap list you can actually plan against.
- 03
Control design and remediation
SecureRoot drafts policies for access, change and incidents and builds the control matrix. Your management approves the policies, your staff acknowledge them, and you assign a named person, not a team, to every control. Your engineers make the technical changes, such as MFA, logging or restricted deploy rights.
- 04
Evidence automation
Grant the access needed to connect your cloud accounts, HR system and code repositories to a compliance platform, if you use one. The platform's subscription is quoted by its vendor, not by SecureRoot. Close the manual evidence gaps the platform cannot reach.
- 05
Observation period (Type 2)
Run every recurring control on schedule across the window, usually three to twelve months, and keep the records dated when they happened. Attend the monthly check-in with SecureRoot and fix drift when the platform flags it. Evidence cannot be backfilled later.
- 06
Audit support
Export the full populations the auditor requests, and make control owners available for walkthroughs; SecureRoot manages the request log and prepares your owners beforehand. Your management reviews the draft report and signs the assertion.
Decisions
Decisions only you can make
- What the system description says. The AICPA's description criteria are the benchmark for preparing and evaluating it, and your management is the preparer.
- Whether to sign the assertion.
- Which CPA firm audits you, and when fieldwork runs.
- Whether to accept a risk rather than treat it.
- Which vendors are in scope, and collecting their own SOC 2 reports.
Budget
Plan for your own team's time
Two costs sit outside SecureRoot's fee: the CPA firm's audit fee, which you pay the firm directly, and your own team's time producing evidence, attending interviews and running reviews across the window. The second appears on no invoice and is usually the larger. SecureRoot's published band for readiness and audit support is ₹1.5 lakh to ₹4.5 lakh, the same for either report type; see the pricing page for what moves an engagement within it.
Scope boundaries
What this does not cover
- SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does, independently of our readiness work.
- SecureRoot cannot run your controls, sign your assertion or create evidence on your behalf.
- Readiness does not guarantee a report without exceptions; the auditor decides what it reports.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- 2018 SOC 2 Description Criteria (With Revised Implementation Guidance, 2022)
AICPA and CIMA · Link checked 2026-11-12
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-12
Related
Services and help that go with this
- SOC 2 compliance checklist
The evidence an auditor samples for each criterion.
- SOC 2 readiness and audit support
The six phases and their deliverables.
- Pricing
Published bands and the fees that sit outside them.
Ready to scope?
A 30 to 45 minute scoping call with SecureRoot sets the criteria, the report type and who on your side owns what.