SOC 2 and ISO, from kick-off to certificate — without your team running the project.
Most compliance projects fail in the same place: a tool gets bought, a long questionnaire lands on an engineering lead who already has a quarter of work, and nine months later there is a dashboard at 73% and no report. We run the engagement instead of handing you one. You answer questions and fix what we find; we do the assessment, the writing, the evidence pack and the handoff to the audit partner who signs.
What "fully managed" means here, specifically
It means the project plan, the assessment, the documents and the auditor relationship are ours. Your side of it is the part nobody can outsource: deciding scope, giving us the evidence, and implementing the fixes. Everything between those is work we do.
- One evidence request, not one per framework. The three standards share far more than they look like they do — 100% of a standard SOC 2 Security, Availability and Confidentiality scope is already covered by the ISO 27001 work, and 84% of ISO 27001 has a SOC 2 counterpart. We assess against the criteria but plan against a crosswalk, so 252 requirement line items collapse into 58 units of work and you are never asked for the same artifact twice.
- A real assessment, not a self-attestation form. Every applicable line item gets a status, a gap description, an owner, an effort size and a priority. We ask for the artifact, never for a yes or no — "send me the last two access reviews, including what was revoked" instead of "do you do access reviews?".
- The documents an auditor asks for. Gap report, remediation plan, evidence index, and for ISO a Statement of Applicability covering all 93 or all 38 Annex A controls with a written justification on every exclusion.
- Remediation support, not a list and a goodbye. We stay through the fixes, write the policies that are missing, and re-test the items we flagged.
- The audit handoff. We introduce the audit partner with the evidence index in hand, which is the artifact that makes an auditor's job cheap and is the reason they refer work back to us.
The four standards we take on
How an engagement runs
Five phases. Phase 3 dominates and scales with scope, which is why phase 1 is where the engagement is won or lost — a scope that quietly includes a second product is the commonest overrun in this work.
| Phase | What happens | Output |
|---|---|---|
| 1 · Scope | Frameworks and SOC 2 categories, systems, environments, locations, legal entities — and for 42001, your role per AI system, which changes applicability more than anything else in the standard. The Type II window conversation happens here, bluntly. | Signed engagement letter and a scope statement |
| 2 · Request | One de-duplicated evidence list, grouped by who produces it rather than by framework: leadership, HR, engineering and IT, operations, legal and procurement, and AI owners for 42001. | The request list, issued |
| 3 · Assess | Every applicable line item gets one of five statuses — met, partial by design, partial by evidence, gap, or not applicable with a written justification. "Partial" always carries a reason, because a remediation plan cannot act on anything less. | A fully statused catalog with gaps and owners |
| 4 · Report | Written for two readers and never blended: an executive summary for whoever funds remediation, and findings specific enough for the engineer who has to fix them, each with the test that will be applied. | Gap report · remediation plan · evidence index · SoA |
| 5 · Handoff | The audit partner is introduced with the evidence index. They audit; we stay on remediation and re-testing until the controls hold. | Audit engaged, with evidence in hand |
The deliverables
- Gap report — executive summary, scope, method, status by domain, and every finding with the test applied to reach it.
- Remediation plan — the non-met items as a sequenced plan, each with an owner, a date and an effort size. Priority is not severity: we rank by what blocks the audit, then period evidence while the window is open, then security risk. A missing asset inventory outranks an exotic technical control, because half the other answers depend on it.
- Evidence index — every requirement mapped to where its proof lives. This is the document the audit partner actually wants.
- Statement of Applicability — ISO only. All 93 or all 38 Annex A controls with applicability, justification and status. Tedious by hand, and the artifact that reads as most professional in the whole pack.
Technical evidence, from a real box
A meaningful share of a readiness report can be evidenced technically rather than taken on trust — TLS configuration, exposed services, patch levels, secrets in repositories, cloud misconfiguration. We run that from a clean, purpose-built scanning environment, provisioned fresh per engagement, and only after written authorization naming the in-scope assets. What cannot be proved technically — governance, training records, management review, supplier assurance — is assessed from evidence and labelled as such. We never let a scan result stand in for a control that was never asked about.
What we will not do
We are not your auditor and never claim to be: a licensed CPA firm issues the SOC 2 report, an accredited certification body issues the ISO certificate, and a firm that both advises and attests on the same controls has a conflict that invalidates the work. We will not state or imply that you have passed — no deliverable of ours carries a badge, and any consultancy that offers you one is selling something worthless. We will not put you on a per-seat compliance platform to deliver a point-in-time assessment, and we will not pretend continuous monitoring is in scope when it isn't. And we will not scope-pad: if one enterprise deal is blocked on a SOC 2 report, we will tell you to do SOC 2 and come back to ISO later.
Who this is for
- SaaS and fintech companies with a deal blocked on a security review
- AI companies being asked for 42001 before they have an ISMS
- Teams who bought a compliance tool and stalled at 70%
- Companies renewing a Type II with exceptions they want to close
- Consultancies and MSPs who want to offer readiness white-labelled
- Anyone who needs both SOC 2 and ISO and does not want to pay twice
Questions buyers ask
Do you run the whole process, or just the gap analysis?
The whole engagement. We scope it, issue one de-duplicated evidence request, assess every applicable criterion, write the gap report, remediation plan, evidence index and ISO Statement of Applicability, work through remediation with your team, and then hand the pack to an independent audit partner who performs the examination or certification audit. Your team answers questions and implements fixes; there is no separate programme for you to staff or project-manage.
Who signs the SOC 2 report or issues the ISO certificate?
An independent audit partner, never TajApps. A licensed CPA firm issues the SOC 2 report; an accredited certification body issues the ISO/IEC 27001 or 42001 certificate. A firm cannot both advise on and attest to the same set of controls, so this separation is required practice rather than a limitation of the service. Audit-partner fees are quoted separately and transparently.
How long does it take?
Readiness itself is typically two to six weeks of assessment depending on scope, plus remediation time that depends entirely on how much is missing. SOC 2 Type I can follow immediately once design gaps are closed. SOC 2 Type II needs an observation window, commonly three months. ISO certification needs the management system to have actually run, including at least one internal audit and one management review, which is roughly three months minimum before a Stage 2 audit.
Which standard should we start with?
ISO/IEC 27001, in most cases, if you need both. It is the superset: all of a standard SOC 2 Security, Availability and Confidentiality scope is covered by the ISMS work, and 84% of the ISO work has a SOC 2 counterpart. Sequencing ISO first and SOC 2 second costs far less than running them as two engagements. If a single enterprise customer is blocking a deal on a SOC 2 report specifically, we will say so and start there instead.
Do you use Vanta, Drata or Secureframe?
No, and we do not put clients on a per-seat compliance platform to deliver a point-in-time readiness engagement. We use our own catalogs — 252 requirement line items mapped to 58 units of work — and our own report generation. If you already own one of those platforms we will work with the evidence it holds.
Is the penetration test really included?
Yes, one full penetration test per compliance engagement, at no additional charge. It is a scoped manual test of an agreed target — an application, an API, a cloud account or a network — delivered with the report an auditor will ask for as evidence. It is a real engagement from the same team, not an automated scan with a cover page.
What do you need from us?
A signed engagement letter, a named owner on your side who can get answers out of leadership, HR, engineering and legal, and the evidence on the request list. Two items are worth starting early because they are the ones almost nobody has ready: a backup restore test record, not the backup configuration, and a completed access review that shows what was actually revoked.
Can we white-label this for our own clients?
Yes. The service is delivered white-labelled by design, and the engagement model is built for resellers and consultancies that want to offer readiness under their own brand. Talk to us about partner terms.
Send us your scope, get a fixed quote
Tell us which frameworks, what the product is, and whether a customer is waiting on a report. We will come back with the scope, the timeline, where the audit partner fits, and a fixed price — plus the penetration test that comes with it.
Email support@tajapps.com →