An independent opinion, not a checklist.
SOC 2 is an attestation examination performed by a licensed CPA firm under AICPA standards. The firm examines the controls relevant to your selected criteria and issues an independent report stating its opinion on them.
The examination is built on the five Trust Services Criteria. Verigo’s Compliance by Design approach embeds those controls into how you already operate — so the evidence the examination needs is generated by the process, not assembled in a panic before each window.
One required. Four by choice.
Security
RequiredThe mandatory Common Criteria — logical and physical access, change management, risk mitigation, and monitoring. Every SOC 2 examination includes it.
Availability
OptionalWhether the system meets the uptime and performance commitments made to customers, including capacity, backup, and recovery.
Processing Integrity
OptionalWhether processing is complete, valid, accurate, timely, and authorized — the data goes in and comes out correctly.
Confidentiality
OptionalHow information designated as confidential is protected across its lifecycle, from collection through disposal.
Privacy
OptionalHow personal information is collected, used, retained, disclosed, and disposed of in line with your privacy notice.
Two examinations. Two questions.
A SOC 2 report comes in two forms. The difference is not the controls you build — it is what the examination is asked to prove about them.
Design, at a point in time.
A Type I examination reports on whether your controls are suitably designed to meet the selected Trust Services Criteria as of a single date — a snapshot of how the system is built.
Operating effectiveness, over time.
A Type II examination reports on whether those controls were not only designed well but operated effectively across an observation window — typically three to twelve months of evidence.
Four service lines, mapped
to the SOC 2 examination lifecycle.
Engage any single stage or move through the whole journey with one accountable, senior-led team — coordinating the independent examination, with a peer-review quality gate on every deliverable.
Readiness Assessment
Scope the examination and find the gaps before the auditor does.
We help you define the right system boundary and Trust Services Criteria, then benchmark your current controls against them — scoring gaps by risk and effort and handing you an independent remediation roadmap.
Implementation Toolkit
Build the controls and the evidence engine the examination will test.
A practitioner-led program that stands up the policies, controls, and procedures behind each criterion — and the evidence-collection routines that make a Type II observation window run quietly in the background.
Pre-Examination Preparation
Walk into the examination knowing the opinion will be clean.
A mock examination run by a lead reviewer independent of your implementation team — testing evidence against the criteria, surfacing exceptions while there is still time to remediate, and coaching your control owners for auditor walkthroughs.
Examination & Renewal Support
Get the report issued — and keep earning it every year.
We coordinate with the licensed CPA firm that performs the independent examination, manage the evidence and exceptions through to a clean opinion, then keep your evidence engine running so each annual renewal is a non-event.
From readiness to a clean opinion.
Here is how a SOC 2 engagement runs in practice — with the observation window that sets a Type II examination apart, and indicative durations.
The outcomes, in detail.
A SOC 2 report is the visible artifact — but the value compounds well beyond the PDF. Here is what the examination actually returns to your business.
A shareable independent report
The deliverable is a licensed CPA firm’s opinion on your controls — a report you can share under NDA to answer security due diligence in one document instead of a hundred emails.
Faster, unblocked sales
Security review is one of the most common reasons enterprise deals stall. A current SOC 2 report removes that blocker and shortens the path from interest to signature.
Less vendor-risk friction
Procurement and vendor-risk teams accept a SOC 2 report in place of bespoke questionnaires, so your team answers diligence once rather than for every prospect.
A repeatable evidence engine
Because controls are embedded into how you operate, each annual renewal draws on evidence the business already generates — the second examination is far lighter than the first.
A foundation you can reuse
The controls behind your SOC 2 map directly onto ISO 27001, HIPAA, and NIST — so the work you do here accelerates every framework that comes next.
A genuinely stronger posture
Beyond the report, the discipline of continuous evidence and monitoring leaves your organization measurably more resilient — not just certified on paper.
Good to know before we start.
Questions on scope, criteria, or the difference between a Type I and Type II examination? A senior practitioner will walk you through it.
Ready for your SOC 2 examination?
Tell us where you are — scoping your first Type I, moving into a Type II window, or renewing an existing report. We'll come back with a scoped plan, fixed pricing, and the fastest path to a clean opinion.