Access control
Joiners, movers and leavers are handled the same way every time, access is reviewed regularly and admin rights are kept separate.
For service providers asked for SOC 2
Ready for your SOC 2 auditControls that hold up in the audit
A SOC 2 report shows your customers that your controls for security and data protection work. It is issued by an independent CPA firm. We help you prepare: we implement the technical controls, collect the evidence and make sure your systems run the way your policies say.
What a SOC 2 report is
SOC 2 is an attestation report under the standards of the American Institute of CPAs (AICPA). A licensed CPA firm examines how a service organization protects the systems it uses to serve customers and reports on it. It is not a certification, and there is no SOC 2 seal that an organization holds. The report goes to your customers, usually under a nondisclosure agreement.
The yardstick is the AICPA Trust Services Criteria. Security is always included. Depending on what your customers need, you can add availability, processing integrity, confidentiality and privacy.
Type I and Type II
| Type I | Assesses whether your controls are suitably designed at a specific point in time |
| Type II | Assesses whether your controls operated effectively over a period, typically 3 to 12 months |
| Who issues the report | A licensed CPA firm, independent of you and of us |
| What customers usually expect | A Type II report, renewed every year |
Many companies start with a Type I report and then move on to Type II. Your auditor will advise you on scope and timing.
Where auditors look most closely
Authentication
MFA for all users, single sign-on where possible and documented exceptions.
Change management
Changes to systems are requested, approved, tested and traceable.
Monitoring and logging
Security events are logged, alerts reach someone and the review is documented.
Backup and recovery
Backups run on schedule, and restore tests are documented.
Vendor management
You know which providers process customer data, and you review their security reports.
A typical path to the first report
- 01
Readiness review
We compare your IT with the Trust Services Criteria in scope and list the gaps. This usually takes a few weeks.
- 02
Closing the gaps
We implement the technical controls, such as MFA, device management, logging and backup. Depending on your starting point, this takes about two to four months.
- 03
Type I or start of the observation period
Your CPA firm tests the design of the controls, or the observation period for Type II begins.
- 04
Type II report
After the observation period the auditor tests whether the controls worked throughout. During that time we keep systems and evidence in order.
Evidence we prepare for your auditor
- User lists with roles and dates of access reviews
- MFA and password settings for all systems in scope
- Records of onboarding and offboarding
- Patch and vulnerability reports
- Backup logs and documented restore tests
- Change records for infrastructure and configuration
- An inventory of systems, devices and cloud services in scope
What we do and what we do not do
We prepare your IT and implement the technical controls. We do not issue SOC 2 reports and do not hold one ourselves. The report always comes from an independent CPA firm that you engage. We will gladly work with the firm you choose.
Experience with access control at scale
Logistics, international · 10,000+ users, Germany
Replacement of an existing identity and access management setup together with a contracted service provider. We advised, managed the project, implemented and set up the processes between the client and the provider.
Result: The help desk works faster thanks to extended permissions, identity processes run automatically and the HR master data is cleaned up.
Updated:
FAQ
Frequently asked questions
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards. The auditor gives an opinion on your controls. There is no certificate, and no one is "SOC 2 certified" in a formal sense.
What is the difference between Type I and Type II?
A Type I report assesses whether your controls are suitably designed at one point in time. A Type II report also tests whether they operated effectively over a period, typically 3 to 12 months. Most customers ask for Type II.
How long does it take to get a SOC 2 report?
It depends on your starting point. Closing the gaps often takes two to four months. A Type I report can follow soon after. For a Type II report you add the observation period of usually 3 to 12 months, so the first Type II report often arrives 6 to 12 months or more after you start.
Can FNLY IT issue our SOC 2 report?
No. Only a licensed CPA firm can issue a SOC 2 report. We prepare your IT, implement the technical controls and collect the evidence the auditor asks for.
Which Trust Services Criteria do we need?
Security is always in scope. Whether you add availability, processing integrity, confidentiality or privacy depends on what you promise your customers. Your auditor will help you define the scope, and we tell you what each choice means for your IT.
Does a SOC 2 report replace security questionnaires?
Often, partly. Many customers accept a current SOC 2 Type II report instead of a long questionnaire or ask only a few follow-up questions. It does not remove every request, but it saves a lot of repeated work.
SOC 2
Let us talk about your SOC 2 plans
Tell us who is asking for the report and how your IT is set up today. We will tell you which gaps we see and how long the preparation is likely to take.