Who does what in a SOC 2 and what to buy: consultants and their cost, whether the auditor can also prepare you, fractional security leadership, what to outsource and what to keep, and the auditor's engagement letter.
What SOC 2 readiness consultants and implementation partners do, how their fees fit into published total cost estimates, the difference between writing policies and building controls, and the independence line between preparing and attesting.
Whether the CPA firm that will issue your SOC 2 can also run the readiness assessment or build controls: the AICPA Code's nonattest service requirements, management responsibilities, documentation, and independence threats from referral and tool arrangements.
When a fractional or virtual CISO makes sense for SOC 2: the responsibilities the criteria expect someone to own, competence and oversight, accountability that stays with management, and how regulators treat outsourced security leadership.
A split of SOC 2 work between your team, an implementation partner, tools and the CPA firm: responsibilities that cannot be outsourced, work partners commonly take on (control implementation, evidence, monitoring), and keeping the auditor independent.
What to check in the CPA firm's engagement terms before a SOC 2 starts: who sets the fee, bundled tool and audit packages, referral arrangements, terms that restrict evidence or communication, and promises the firm is not allowed to make.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.