A two week assessment that moved a six month deadline
SOC 2 Type II required by an enterprise buyer, with a target date the organisation had no path to.
- Controls mapped
- 072+72
- Open gaps
- 3711-70%
- Audit date
- unknownmonth 10defined
Gap assessment against SOC 2 Type II trust services criteria. Source: assessment report, February 2025
Context
A retail group with a signed letter of intent from an enterprise customer, conditional on SOC 2 Type II certification within six months.
The constraint
The thing that ruled out the obvious answer.
The six month date came from the customer, not from the auditor. Type II requires a continuous observation window, so no amount of spend could compress it below the window itself plus remediation.
Diagnosis
The organisation had more controls in place than it realised and less evidence than it needed. Access reviews were happening, they were happening in a chat thread. The gap was documentation and consistency, not security posture.
What we rejected, and what we chose instead
Any firm can describe what it built. The useful record is the option that was on the table and did not survive.
Rejected
Engage a traditional compliance consultancy for the full programme
It would have taken four weeks to reach the same finding at several times the cost, and still not changed the observation window. The client needed a date they could take back to the customer, quickly.
Chosen
Two week gap assessment, then remediation run by the internal team
The fastest path to an honest date. The internal team was capable of the remediation once someone told them precisely what evidence was missing.
What was actually implemented
- 0172 trust services controls mapped against current practice in eight working days
- 02Every gap classified as documentation, tooling or genuine control absence
- 03Evidence collection automated where the tooling already existed
- 04Remediation plan sequenced so the observation window could start as soon as remediation closed
- 05Renegotiation brief for the customer conversation, with the real date and the reason
Measured, not estimated
72 controls mapped and 26 gaps closed by the internal team within eight weeks. The customer accepted a revised date of month 10 because it arrived with evidence instead of an assurance.
Gap assessment against SOC 2 Type II trust services criteria. Source: assessment report, February 2025
Instead of a roadmap presentation, we received a plan we could execute.
More from leadership and assurance
Leadership and assurance
Fractional leadership, managed platform teams and compliance readiness for organisations that need the seniority before they can justify the salary.