SOC 2 compliance for Canadian companies, scoped down to what your customers actually asked for, then evidenced.
One Canadian team runs the SOC 2 readiness work: scoping the criteria, closing the gaps, and packing the evidence.
Most companies scope five criteria when their customers only ever asked about one. Only one of the five trust services criteria, security, is mandatory. The rest is a decision with a price attached.
A gap list with a named owner, a price, and a date against every line. You keep that list whether or not you carry on with us.
Policies, tickets, logs and screenshots, mapped to the criteria before your auditor asks twice. We attest to nothing ourselves, because a SOC 2 consultant who designed your controls cannot grade them.
There's no SOC 2 certification and no certifying body. There's a licensed CPA firm's SOC 2 attestation, and the evidence sitting under it.
IN PRODUCTION
Our biggest prospect wanted SOC 2 and we'd been quoting five criteria to everyone because a blog told us to. SMEnode read the actual security questionnaire, cut us to security and confidentiality, and we passed the window six months earlier than planned. Nobody has asked for the other three since.
I run this practice, so this is written by the engineer who'll sit on the scoping call, not a product page.
Nobody in Canada is legally required to hold a SOC 2 report. Your customers require it, which is a harder deadline than a law. Good work starts by cutting scope, not adding it. Only one of the five trust services criteria is mandatory: security, the common criteria every examination covers. Availability, processing integrity, confidentiality and privacy are choices, and each one you add buys more controls, more evidence, and a longer window. So the first question isn't which criteria you want. It's which ones the customer who triggered this asked for, in writing, in their security questionnaire.
Then it's plumbing. Access reviews that happen on a date rather than when somebody remembers, offboarding that closes every account, change tickets that link to the change, logs kept as long as the policy claims. Most gaps we find in SOC 2 readiness work aren't missing tools. They're a control that works but produces nothing an auditor can read. That's the cheapest kind to fix and the easiest to leave broken.
Where does the money go? Not the SOC 2 audit fee. Scope sets the price, remediation eats the budget, and a Type 2 window runs three to twelve months, so a bad scoping decision in month one is a bill you pay for a year. In Canada the report comes from a CPA firm working to the CPA Canada SOC 2 guide under CSAE 3000, with the AICPA's criteria underneath. Search for SOC 2 certification and you'll be shopping for a document nobody issues. What exists is a SOC 2 attestation carrying a licensed CPA firm's opinion. If your customers are federally regulated, OSFI's B-10 third-party risk guideline is usually what put SOC 2 in your contract. It won't cover PIPEDA.
Four steps, and step 01 is reading somebody else's paperwork. We want the security questionnaire, the contract clause, or the email that started this. Nine times in ten it names fewer criteria than the internal plan assumed, sometimes just security. That document sets the scope, the cost and the date. Guessing at it is how a nine-month project becomes an eighteen-month one.
We start from your customer's actual words, not a framework poster. Which criteria, which report type, which deadline, and whether a Type 1 buys enough time to close the deal while the longer window runs underneath it.
Every control tested against the criteria in scope, each gap written up with a named owner, an effort estimate and a cost. You get the list whether or not you carry on with us.
We build what's missing and, just as often, make an existing control produce proof. Screenshots, tickets, exports and policies, collected as you go rather than in a panic.
We help you pick a CPA firm, prepare the description of the system, and answer the evidence requests. Then we step back, because the firm that built your controls cannot be the firm that grades them.
Answers first, including the one where we tell you the certificate you're asking for doesn't exist. An architect takes the call, not a salesperson.
Ces disciplines partagent la même équipe chevronnée et arrivent souvent ensemble. Suivez le fil jusqu'à la prochaine.
PARLONS-EN
Un spécialiste chevronné répond en moins d'une heure, 24/7.