SOC 2 READINESS SUPPORT
A customer requires a SOC 2 report. Your team needs a clear plan for getting ready.
Business Communication Solutions helps small businesses review existing security controls, identify gaps, organize evidence, and complete agreed improvements alongside their current IT administrator or IT provider.
Your IT administrator already knows your environment. BCS can contribute a second set of eyes, specialized security support, practical documentation, and a gap tracker that turns findings into assigned work.
We agree on responsibilities before implementation: what your team will handle, where BCS will assist, and what management needs to approve. Support can be project-based or co-managed.
We begin with your customer requirements and the scope agreed with your CPA auditor. We compare your actual practices and available evidence with the relevant Trust Services Criteria, with a focus on Security engagements.
Review accounts, devices, cloud services, policies, procedures, and records. Distinguish controls that are implemented from work that is only planned.
Record gaps, priorities, responsible people, deadlines, dependencies, and evidence needed to demonstrate completion.
Help develop or improve access-management, BYOD, incident-response, change-management, and vendor-review procedures that reflect your actual operations.
Review agreed corrections and organize configuration reports, approvals, review records, and incident documentation for auditor requests.
Type I addresses the system description and suitability of control design as of a specified date. Controls must be implemented; a written intention to configure them later is not enough. BCS helps organize gaps, implementation verification, and evidence for the agreed date.
Type II also evaluates operating effectiveness over an agreed period. We help establish recurring tasks, responsible people, and evidence collection so controls remain demonstrable over time. Confirm the examination period and testing expectations with your auditor.
Security-only engagements use the Common Criteria groups CC1–CC9. Our review considers management oversight, communication, risk assessment, evaluation of controls, policies and procedures, access protection, system operations, change management, and vendor and disruption risks.
Buying a security product addresses only part of the work. The team also needs to know who approves access, who investigates alerts, how changes are controlled, and how those activities are recorded.
A small business can have a substantial cloud footprint even without an office network. BCS can help review company identities, MFA, administrative permissions, device management, encryption, and cloud-application access.
For personally owned devices, we review management permissions, data handling, employee agreements, and offboarding. Mobile company-data removal requires an appropriate enrollment and application configuration. Licensing and technical suitability are reviewed before recommendations.
Explore our Microsoft Intune setup and support and Microsoft 365 support.
Where agreed, BCS can provide endpoint protection and MDR supported by a 24/7 SOC partner, with supported cloud integrations and predefined containment actions. We document coverage, escalation, response authority, and reporting responsibilities. Tools support readiness; they do not establish it by themselves.
Learn about our cybersecurity services.
Timing and cost depend on scope, existing documentation, required remediation, and team availability. BCS readiness fees are separate from CPA examination fees and additional software or licensing costs.
BCS has supported clients during SOC 1 and SOC 2 audits by gathering and submitting IT-control evidence, including onboarding, account provisioning, and account deactivation. That experience informs our practical approach to connecting procedures with records.
BCS provides readiness consulting, technical assistance, and evidence support. The independent CPA firm performs the SOC 2 examination and issues the report. Management retains ownership of its controls and representations. BCS does not issue SOC 2 reports or guarantee an audit outcome.
Yes. We define the work BCS will perform and coordinate with your administrator on implementation, verification, and evidence.
Recommendations depend on risks, customer commitments, applicable criteria, and existing controls. We assess those needs before suggesting products.
Bring the auditor engagement letter and agreed scope, customer requirements, target dates, any questionnaire or evidence requests, and an overview of systems and existing policies.
We can review the remaining work and discuss a realistic scope. Whether the target date is achievable depends on the findings and the time available to implement and verify corrections.
Tell us what your customer requires and where your team needs help. BCS supports Austin and Houston businesses with focused gap reviews, co-managed security support, documentation, and evidence preparation.
Austin: 512-257-1433 Houston: 281-815-8784
Reference: AICPA Trust Services Criteria. Confirm the requirements and scope applicable to your engagement with your CPA auditor.