Our expertise/SOC 2 readiness

SOC 2 readiness

Give global clients confidence in your controls.

Prepare for independent assurance with a practical control programme, clear evidence and a readiness plan aligned to your customer commitments.

Discuss SOC 2 readiness ↗

Designed for your context

The right support
for the decision ahead.

For Philippine BPO, IT services and SaaS businesses responding to international customer assurance requirements.

What we deliver

Scope tailored to your organisation

Type I / Type II readiness

Assess the organisation’s starting point and the readiness activities appropriate to the intended examination.

Trust Services Criteria gap analysis

Review the applicable criteria covering security and the additional categories relevant to scope: availability, processing integrity, confidentiality and privacy.

Control design & implementation

Define control activities, owners and operating procedures around the agreed system boundaries.

Policy & procedure documentation

Prepare usable documentation aligned with actual operating practices.

Evidence management

Establish the collection, organisation and review of evidence needed to demonstrate control operation.

Independent auditor preparation

Coordinate readiness information and preparation with the selected CPA auditor.

Continuous monitoring

Design ongoing monitoring, issue tracking and improvement routines.

Tangible outputs

Leave with more
than recommendations.

  • Readiness and gap assessment
  • Control and responsibility matrix
  • Policy and procedure set
  • Evidence collection plan
  • Auditor-preparation and monitoring roadmap

A clear path to progress

  1. 01

    Agree scope and intended examination

  2. 02

    Assess gaps and design controls

  3. 03

    Operate controls and organise evidence

  4. 04

    Prepare for independent examination

Philippine context & engagement boundaries

Gardoce provides readiness support, not the independent SOC 2 attestation report. Examination scope, applicable criteria, reporting period and auditor requirements are confirmed with the selected independent CPA firm.

Questions worth asking

How is the engagement scoped?

We start with your priorities, operating context and current capabilities. The proposal sets out deliverables, responsibilities, dependencies and acceptance criteria.

Can this connect with other Gardoce services?

Yes. Related advisory, security, architecture and implementation work can be coordinated, with each workstream’s scope and ownership made explicit.

Every engagement starts with a clear scope, agreed responsibilities and practical outcomes.

Start with a conversation

What needs to move
forward in your organisation?

Tell us the decision, risk or operational challenge you are facing. We will help define a sensible next step.

Discuss your priorities ↗