CxO™ DELIVERABLE
SOC 2 Readiness Assessment
A SOC 2 readiness assessment is a pre-audit review of your controls against the AICPA Trust Services Criteria. DAG Tech's vCCO confirms your scope, tests each control, finds the gaps and builds the plan and evidence you need before your CPA firm starts a Type I or Type II audit.
Custom proposal · Last updated October 2026
The Short Answer
What Is a SOC 2 Readiness Assessment?
A SOC 2 readiness assessment tests whether your controls meet the AICPA Trust Services Criteria you plan to report on, so gaps are fixed before a licensed CPA firm performs the actual SOC 2 audit. SOC 2 reports cover five Trust Services Criteria categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security, also called the Common Criteria, is required in every SOC 2. The others are added when they matter to your customers. A Type I report describes your system and evaluates whether controls are suitably designed at a single point in time. A Type II report also tests whether those controls operated effectively over an observation period, usually several months to a year. Most enterprise buyers ask for Type II. Only a licensed CPA firm can issue a SOC 2 report. DAG Tech does not issue SOC 2 reports; we get you ready for the firm that does.
The readiness assessment answers three questions: which criteria and systems are in scope, which controls are missing or undocumented, and what evidence the auditor will expect. The vCCO also helps you write the system description and sets up evidence collection so your observation period starts clean. If you use a compliance automation platform, we work inside it. After the readout, the vCCO recommends who should close each gap: your team, another provider or DAG Tech when it is the best fit.
At a glance
SPEC SHEET- DELIVERABLE TYPE
- Framework readiness assessment
- ALSO KNOWN AS
- SOC 2 pre-audit, SOC 2 gap assessment, SOC 2 readiness review
- PRACTICE AREA
- IT Compliance (CxO™)
- BEST FOR
- Service organizations, SaaS and technology vendors whose customers ask for a SOC 2 report
- WHAT WE NEED
- Target criteria, in-scope systems, current policies and customer requirements
- NEXT STEP
- Request a SOC 2 readiness proposal
Scope
What We Evaluate
We test your controls against the Trust Services Criteria you plan to include in your report.
Scope and criteria selection
Which services, systems and criteria belong in the report, and whether Type I or Type II fits your timeline.
Control environment
Governance, board oversight, roles, hiring and accountability under the Common Criteria.
Risk assessment
Whether you identify, analyze and respond to risks, including fraud and change risk.
Logical access
Provisioning, MFA, access reviews and offboarding across platforms like Okta, Entra ID, AWS and Azure.
System operations
Monitoring, vulnerability management and incident detection and response.
Change management
How code, infrastructure and configuration changes are approved, tested and tracked.
Vendor management
How subservice organizations are reviewed, including their own SOC reports.
Additional criteria
Availability, Processing Integrity, Confidentiality or Privacy controls when they are in scope.
The Deliverable
What You Receive
- SOC 2 scope recommendation and Type I or Type II decision
- Control-by-criteria gap report
- Control matrix ready for your CPA firm
- Draft system description outline
- Evidence collection plan for the observation period
- Remediation roadmap with owners, dates and scoped hours
How It Works
How It Runs
- STEP 01
Kickoff
We confirm the services in scope, the criteria to include and the date customers expect a report.
- STEP 02
Control Mapping
The vCCO maps your existing controls and policies to each Trust Services Criterion.
- STEP 03
Readiness Testing
We test design, and sample operating evidence, the way an auditor would.
- STEP 04
Readout
You get the gap report, control matrix and a plan to be audit-ready.
When to Start
Signs You Need a SOC 2 Readiness Assessment
- A prospect will not sign without a SOC 2 report.
- Security questionnaires are slowing down your sales cycle.
- You do not know whether to start with Type I or Type II.
- Your policies exist but nobody can show evidence they are followed.
- You bought a compliance platform and it shows a long list of failing controls.
- You want to start your Type II observation period without surprises.
Compare
SOC 2 Readiness Assessment vs. SOC 2 Audit
| SOC 2 Readiness Assessment | SOC 2 Audit | |
|---|---|---|
| Question it answers | Are our controls ready for the auditor? | Do our controls meet the criteria, and did they operate effectively? |
| Output | Gap report, control matrix, evidence plan and roadmap | Formal SOC 2 Type I or Type II report you share with customers |
| When | Before the audit or before the Type II observation period starts | After readiness gaps are closed |
| Led by | DAG Tech virtual compliance officer (CxO™) | An independent licensed CPA firm |
Related
Often Paired With
FAQ
SOC 2 Readiness Assessment Questions
What is a SOC 2 readiness assessment?
It is a pre-audit review of your controls against the AICPA Trust Services Criteria. It shows what is missing before a CPA firm starts the formal SOC 2 audit, so you avoid exceptions in your report.
Does DAG Tech issue SOC 2 reports?
No. Only a licensed CPA firm can issue a SOC 2 report. DAG Tech prepares you for the audit and coordinates with the firm you choose.
What is the difference between SOC 2 Type I and Type II?
Type I evaluates whether your controls are suitably designed at a single point in time. Type II also tests whether they operated effectively over an observation period, usually several months to a year. Most enterprise customers ask for Type II.
Which Trust Services Criteria do we need?
Security is required in every SOC 2. Availability, Processing Integrity, Confidentiality and Privacy are optional and should match what your customers rely on you for. The vCCO recommends a scope based on your contracts and services.
How much does a SOC 2 readiness assessment cost?
Every deliverable is scoped in hours at the CxO rate, based on the criteria in scope and the number of systems. Your proposal shows the total before work starts.
Do we need compliance automation software?
Not always. Platforms can help collect evidence, but they do not set scope or close gaps. The vCCO works with your platform if you have one, or sets up a simple evidence process if you do not.
Get Started
Request a SOC 2 readiness assessment
Tell us what you need. We scope the hours and send a CxO proposal.
Sent with your request: CxO: vCCO: SOC 2 Readiness Assessment
- 01A scoping call with a fractional executive
- 02Every task, deliverable, hour and cost in one proposal
- 03A roadmap with start date
The CxO™ Program
Explore Every Practice Area
About DAG Tech SOC 2 Readiness Assessment
A SOC 2 readiness assessment is a pre-audit review of your controls against the AICPA Trust Services Criteria. DAG Tech’s vCCO confirms your scope, tests each control, finds the gaps and builds the plan and evidence you need before your CPA firm starts a Type I or Type II audit.
A SOC 2 readiness assessment tests whether your controls meet the AICPA Trust Services Criteria you plan to report on, so gaps are fixed before a licensed CPA firm performs the actual SOC 2 audit. SOC 2 reports cover five Trust Services Criteria categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security, also called the Common Criteria, is required in every SOC 2. The others are added when they matter to your customers. A Type I report describes your system and evaluates whether controls are suitably designed at a single point in time. A Type II report also tests whether those controls operated effectively over an observation period, usually several months to a year. Most enterprise buyers ask for Type II. Only a licensed CPA firm can issue a SOC 2 report. DAG Tech does not issue SOC 2 reports; we get you ready for the firm that does.