SOC 2 access-control readiness
A large share of SOC 2 audit requests are about access: who can get into what, how that is approved, and how quickly it is removed. This package gets those controls in place and collects the evidence, so the access section of your audit is ready.
$4,000fixed price, about 20 hours at $200/hr
Prices shown are for Series A companies. Pricing for Series B to D and IPO-stage companies may vary and is quoted after a free scoping call.
Who it's for
- Startups preparing for a SOC 2 audit
- Companies facing an enterprise customer's security review
- Teams using Vanta or Drata who need someone to do the technical work
What's included
- Identity and device controls mapped to SOC 2 requirements
- Access review process with evidence your auditor can use
- MFA, onboarding and offboarding evidence collected
- Works alongside Vanta, Drata or your auditor
What you'll need
- Admin access to your identity system and core apps
- Your compliance platform or auditor's control list, if you have one
Free 20-min call
We look at your setup and what you need.
Written scope
A fixed price and timeline before anything starts.
The work
Done remotely or onsite, with progress updates.
Handoff
Runbooks and a walkthrough so your team can run it.
Work is done remotely, or onsite in New York City, Connecticut, Rhode Island and Massachusetts, and anywhere in the US or worldwide. Outside those four areas the client covers airfare, lodging, ground transport and daily expenses at cost. Every package is priced from a $200 hourly rate, and you get the fixed price in writing before anything starts. Listed prices apply to Series A companies; Series B to D and IPO-stage companies may be priced differently.
Questions
Does this get us SOC 2 certified?
No one can promise that except your auditor. This package covers the access-control part of SOC 2 and the evidence for it; your auditor assesses the whole program.
Do we need Vanta or Drata?
No, but if you use one, the evidence is collected in the format it expects.
Type I or Type II?
Both. For Type II the access review process is set up to run on a schedule, so evidence builds up across the audit period.
Related packages
Ready to start?
Book a free 20-minute call with the engineer who would do the work, or tell us about your team. You get a written scope and fixed price before any work starts.