A Business-Aligned Scope
Define the services, system boundaries and relevant Trust Services categories.
SOC 2 type i & type ii
Build evidence of trust.
Prepare your controls.
Support customer assurance.
Prepare for an independent SOC 2 examination with a clear scope, practical controls and reliable evidence. Cyber360 supports readiness, remediation and audit coordination for Type I and Type II reporting.
Standards & assurance • Clear scope. Practical evidence.
Understand → Improve → Validate
From questions to decisions
Turn assurance expectations into an operating programme.
Prospects and partners need to understand how your service is controlled. We help translate those expectations into system boundaries, control ownership and evidence that supports the independent auditor’s examination.
Evidence That Reflects Operation
Connect control design with ownership, execution and retained records.
A Sustainable Programme
Prepare for the examination while improving routine control and evidence processes.
When it adds value
Focus effort where it can make a difference.
A New Assurance Requirement
Clarify the business objective, scope and evidence expected by stakeholders.
A Changing Environment
Review the impact of new services, technology, suppliers or operating practices.
Unclear Ownership
Connect decisions and controls with named owners and practical responsibilities.
Preparing for Improvement
Establish a baseline and prioritise actions around risk and delivery dependencies.
Service areas
A structured path to practical improvement.
These are examples for scoping, not an all-inclusive package. Technologies, delivery expertise, access requirements and outputs are confirmed before an engagement.
01
Scope & Reporting Strategy
What should the report cover?
- Example scope
- Services, system boundaries, third-party dependencies and customer assurance needs.
- What we examine
- Type I or Type II objectives and relevant Security, Availability, Confidentiality, Processing Integrity or Privacy categories.
- Evidence to take away
- A scope and examination-readiness plan for discussion with the CPA firm.
02
Readiness & Gap Assessment
Where is the control environment incomplete?
- Example scope
- Applicable criteria, existing controls, policies and available operational evidence.
- What we examine
- Control design, implementation gaps, ownership and remediation priorities.
- Evidence to take away
- A readiness report and risk-prioritised implementation roadmap.
03
Control Design & Policies
Can controls operate consistently?
- Example scope
- Access, changes, risk, suppliers, monitoring, incident response and other scoped processes.
- What we examine
- Practical responsibilities, procedures and suitability for the agreed system and criteria.
- Evidence to take away
- A control matrix and tailored policy and procedure suite.
04
Evidence Management
Can you demonstrate what happened?
- Example scope
- Collection workflows, repositories, reviews and the proposed examination period.
- What we examine
- Completeness, traceability, control frequency, exceptions and evidence quality.
- Evidence to take away
- Evidence requirements, owner assignments and a collection calendar.
05
Pre-Examination Review & Coordination
Are teams ready for the independent auditor?
- Example scope
- Control walkthroughs, evidence reviews, interviews and auditor request coordination.
- What we examine
- Remaining gaps, readiness limits and the actions needed before or during the examination.
- Evidence to take away
- Readiness findings and an organised audit-support package.
06
Ongoing Control Operation
Can the programme sustain assurance?
- Example scope
- Recurring controls, change reviews, exception handling and subsequent reporting cycles.
- What we examine
- Evidence continuity, follow-up actions and changes to the service or control environment.
- Evidence to take away
- A monitoring programme and future-cycle improvement plan.
How it works
A clear path from review to improvement.
- 01
Agree Scope and Objectives
Define services, categories, reporting type and auditor coordination needs.
- 02
Assess Readiness
Review control design, implementation and available evidence.
- 03
Remediate Gaps
Develop agreed controls, policies and accountable delivery actions.
- 04
Operate and Record
Establish control routines and retain evidence for the agreed period.
- 05
Support Examination
Coordinate evidence requests and readiness activity with the independent CPA firm.
- 06
Sustain Assurance
Track exceptions, changes and ongoing evidence for subsequent cycles.
What you receive
Clear enough to decide.
Detailed enough to act.
The reporting package is agreed around your audience and the decisions it needs to support.
Leadership & Assurance Owners
- Scope and reporting-strategy recommendations.
- Gap assessment and implementation roadmap.
- Readiness status, dependencies and remaining risks.
- Ongoing control-governance and review priorities.
Control & Audit-Support Teams
- Control matrix, policies and procedures.
- Evidence repository structure and collection calendar.
- Pre-examination review findings and action register.
- Auditor request coordination and handover materials.
Meaningful progress
Track the improvement.
Keep the evidence.
Agree what completion means for each action: an approved design decision, a reviewed configuration, a resolved finding or a demonstrated process. Record owners, dependencies, exceptions and the evidence available.
A closed task is not automatically a validated security outcome. Choose the follow-up review or test that answers the original question, and record what remains unverified.
Preparing the engagement
Start with the right context.
01
Scope & Objectives
- Identify services, systems and the assurance question driving the work.
- Share relevant obligations, stakeholder expectations and target dates.
02
Evidence & Context
- Provide existing policies, risk assessments, architecture and prior findings.
- Identify suppliers and dependencies relevant to the agreed scope.
03
People & Ownership
- Nominate business, technical, risk and operational contacts.
- Confirm decision authority and ownership of implementation actions.
04
Delivery & Follow-Up
- Agree work packages, access, constraints and acceptance criteria.
- Scope independent assurance, system changes and active testing explicitly.
Reference guidance: AICPA: SOC suite of services. Relevant practices are selected for the agreed scope; independent assurance and implementation boundaries are confirmed during scoping.
Clear boundaries
Know what the work establishes.
The engagement applies to the agreed scope and evidence. Your organisation retains responsibility for decisions and control operation. Independent audits, certification or attestation, specialist legal advice, production changes and active testing are separately agreed; outcomes are not guaranteed.
ISO 27001
Build a practical information security management system.
Explore the service →Data Privacy & Protection
Connect governance with personal-data risk and operations.
Explore the service →Defensive Security
Review security architecture, controls and operational readiness.
Explore the service →Practical questions
Before we get started.
How do Type I and Type II differ?
Type I addresses control design at a specified date. Type II additionally addresses operating effectiveness over a specified period. Scope and timing are agreed with the independent CPA firm.
Who issues the SOC 2 report?
An independent licensed CPA firm performs the examination and issues the report. Cyber360 provides consulting and readiness support; the report and opinion are not guaranteed deliverables of consulting.
Is SOC 2 a certification?
SOC 2 is an attestation report, not an ISO-style certification. The report describes the scoped system and the independent auditor’s opinion.
Must all five categories be included?
The Security common criteria form the foundation. Additional categories are selected according to the service, commitments and user needs, in discussion with the auditor.
Take a closer look
The service overview,
ready to share.
Download the Cyber360 SOC 2 Type I & Type II brochure for the service scope, engagement approach, deliverables and preparation guidance.
PDF · 4 pages · 520 KB
Your next step
What evidence do your customers need to trust your service?
Tell us the decision you need to make. We’ll help define a useful scope.