02 / SOC 2 READINESS
Turn a customer requirement into a practical security programme. From your first gap assessment to support through the independent SOC 2 examination.
Book a 30-minute callTHE STARTING POINT
For SaaS companies, software teams and service providers preparing for their first SOC 2 report, responding to enterprise procurement, or planning a Type II engagement.
We start with your services, customer commitments and current controls. Together, we define the system boundary, relevant Trust Services categories and target report type before planning the work.
Security is the foundation of the scope. Availability, Confidentiality, Processing Integrity and Privacy are considered where relevant to your services and commitments. Penetration testing is a separate engagement unless expressly included.
AFTER THE GAP ASSESSMENT
Documented gaps, evidence reviewed, business context and recommended actions against the agreed criteria.
THE DELIVERY PLAN
Sequenced workstreams, owners, dependencies and target milestones — based on your starting point and team availability.
THE WORKING CHECKLIST
A control register showing what exists, what needs work and which policies and evidence are required.
THE INVESTMENT DECISIONS
A scoped implementation proposal and recommended purchases or testing. Supplier quotes are confirmed separately; penetration testing is scoped separately.
These are gap assessment outputs. Implementation, tooling deployment and audit support follow under an agreed scope.
YOUR PATH TO READINESS
Confirm the system boundary, target report type, relevant criteria and business deadlines.
Review existing controls and evidence, then walk through the gap assessment report and prioritised roadmap.
Lead the agreed work programme: develop policies, coordinate control improvements, organise evidence and track readiness with your team.
Coordinate evidence requests, prepare control owners for discussions and help address questions and gaps raised by the independent CPA firm.
BROONAT provides readiness and implementation support. An independent licensed CPA firm performs the SOC 2 examination and issues the report. Auditor selection, fees and timing are agreed separately; the auditor determines the opinion.
HANDS-ON IMPLEMENTATION
When the roadmap calls for new security tooling, we can take it from requirements and budget planning through procurement, technical deployment and handover.
Define requirements, review your existing stack, compare suitable tools and recommend a budget and implementation plan.
Work with vendors on quotes and licensing, help arrange the purchase with your approval, and set up subscriptions under your organisation’s ownership.
Install, configure and integrate the agreed tools into your environment — such as endpoint protection, device management, identity and access management, or vulnerability management.
Check the agreed configuration and integrations, document the setup and walk your team through day-to-day operation. Ongoing administration can be scoped separately.
Tool selection, purchases and technical changes are agreed with you before execution. Implementation is separately scoped from the gap assessment and performed with authorised access. Licences and other third-party charges are budgeted separately from BROONAT’s service fees.
WHO DOES WHAT
BROONAT / DELIVERY OWNERSHIP
One point of contact to lead the agreed programme and keep it moving.
Review gaps, set priorities and maintain the delivery roadmap.
Draft practical policies and coordinate risk assessment and treatment.
Select tools, coordinate approved purchases, configure and integrate.
Organise collection, track actions and check readiness with control owners.
Coordinate requests, prepare your team and help address auditor questions.
YOUR TEAM / DECISIONS & ACCESS
Your sponsor and control owners provide access and context, approve policies and risk decisions, and authorise or make operational changes.
We make the actions needed from your team clear. Your organisation remains responsible for its controls.
INDEPENDENT ASSURANCE
An independent CPA firm evaluates the evidence, performs the SOC 2 examination and issues its report.
BROONAT supports preparation and audit coordination; assurance decisions remain independent.
PLANNING AHEAD
Preparation for an examination of control design at a specified date. Useful when you need to establish an initial assurance baseline.
Preparation for an examination that also evaluates operating effectiveness over a defined period. We help plan recurring controls and evidence collection for the period agreed with your auditor.
Assessment, implementation and the independent examination are separate stages. We confirm the assessment schedule upfront and refine implementation milestones after reviewing your readiness. A Type II observation period must be planned with the auditor.
YOUR NEXT MOVE
Tell us what your customer is asking for, your target timing and what you already have in place. We’ll help define the next step.
Book a 30-minute callScope, timing and fees agreed before work begins.
