The Problem
An enterprise customer just asked for your SOC2 report. Or your investor wants ISO 27001 on the roadmap. The process feels opaque, expensive, and time-consuming. It does not have to be. With the right guidance, most B2B SaaS companies can go from zero to audit-ready in 8–12 weeks.
What You Get
- Gap analysis: where you stand today against SOC2 Type I/II or ISO 27001 controls.
- Policy and procedure drafting: information security, access control, incident response, vendor management, and more.
- Evidence collection guidance: what your auditor will ask for and how to organise it.
- Control implementation support: helping your team close gaps efficiently.
- Auditor coordination: helping you choose the right auditor and preparing for the audit.
- Ongoing compliance support if needed (retainer option).
Our Approach
We do not believe in compliance theatre. Our goal is to help you build a security programme that actually protects your business — and happens to pass the audit. We start with a gap analysis, build a realistic timeline, draft practical policies, and keep your engineering team involved throughout.
Deliverables
- Gap analysis report with control-by-control assessment
- Compliance roadmap with timeline and milestones
- Full policy suite (typically 8–12 policies)
- Evidence collection templates and guidance
- Auditor selection support and preparation
- Pre-audit readiness review
Timeline
SOC2 Type I readiness: 8–12 weeks. ISO 27001 readiness: 10–16 weeks. SOC2 Type II requires the Type I foundation plus a 3–6 month observation period.
Frequently Asked Questions
SOC2 or ISO 27001 — which do we need?
If your customers are primarily US-based, SOC2 is usually the ask. For European or global customers, ISO 27001 carries more weight. Some companies pursue both.
How much does the whole process cost?
Our advisory fees depend on scope. The audit itself (by a third-party firm) typically costs £10,000–£30,000 for a startup. We help you choose a cost-effective auditor.
We are a 10-person startup. Is this too early?
Not if enterprise customers are asking. Smaller teams often achieve compliance faster because there are fewer systems to document.
Enterprise customers asking about compliance? Let us get you audit-ready.