SOC 2 compliance work that ends in a report your buyer accepts
Trusted by
SOC 2 compliance, three pillars, one operator.
One Canadian team runs the SOC 2 readiness work: scoping the criteria, closing the gaps, and packing the evidence.
Scope it down
Most companies scope five criteria when their customers only ever asked about one. Only one of the five trust services criteria, security, is mandatory. The rest is a decision with a price attached.
Close the gaps
A gap list with a named owner, a price, and a date against every line. You keep that list whether or not you carry on with us.
Pack the evidence
Policies, tickets, logs and screenshots, mapped to the criteria before your auditor asks twice. We attest to nothing ourselves, because a SOC 2 consultant who designed your controls cannot grade them.
Does SOC 2 Compliance Services work the same way in every industry?
No. The SOC 2 Compliance Services work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
The report your enterprise customers ask for before signing.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from SOC 2 Compliance Services?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- SOC 2 Compliance Services
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584SOC 2 compliance in Canada, made real.
I run this practice, so this is written by the engineer who'll sit on the scoping call, not a product page.
Cutting scope is the first decision, not the last.
Nobody in Canada is legally required to hold a SOC 2 report. Your customers require it, which is a harder deadline than a law. Good work starts by cutting scope, not adding it. Only one of the five trust services criteria is mandatory: security, the common criteria every examination covers. Availability, processing integrity, confidentiality and privacy are choices, and each one you add buys more controls, more evidence, and a longer window. So the first question isn't which criteria you want. It's which ones the customer who triggered this asked for, in writing, in their security questionnaire.
Most gaps are evidence problems, not tooling problems.
Then it's plumbing. Access reviews that happen on a date rather than when somebody remembers, offboarding that closes every account, change tickets that link to the change, logs kept as long as the policy claims. Most gaps we find in SOC 2 readiness work aren't missing tools. They're a control that works but produces nothing an auditor can read. That's the cheapest kind to fix and the easiest to leave broken.
Where the money goes, and who actually signs.
Where does the money go? Not the SOC 2 audit fee. Scope sets the price, remediation eats the budget, and a Type 2 window runs three to twelve months, so a bad scoping decision in month one is a bill you pay for a year. In Canada the report comes from a CPA firm working to the CPA Canada SOC 2 guide under CSAE 3000, with the AICPA's criteria underneath. Search for SOC 2 certification and you'll be shopping for a document nobody issues. What exists is a SOC 2 attestation carrying a licensed CPA firm's opinion. If your customers are federally regulated, OSFI's B-10 third-party risk guideline is usually what put SOC 2 in your contract. It won't cover PIPEDA.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our SOC 2 readiness and gap assessment work runs.
Four steps, and step 01 is reading somebody else's paperwork. We want the security questionnaire, the contract clause, or the email that started this. Nine times in ten it names fewer criteria than the internal plan assumed, sometimes just security. That document sets the scope, the cost and the date. Guessing at it is how a nine-month project becomes an eighteen-month one.
Engagement phases
Phases 01 to 04
Read the ask
We start from your customer's actual words, not a framework poster. Which criteria, which report type, which deadline, and whether a Type 1 buys enough time to close the deal while the longer window runs underneath it.
Assess and price the gaps
Every control tested against the criteria in scope, each gap written up with a named owner, an effort estimate and a cost. You get the list whether or not you carry on with us.
Close and evidence
We build what's missing and, just as often, make an existing control produce proof. Screenshots, tickets, exports and policies, collected as you go rather than in a panic.
Hand off to the auditor
We help you pick a CPA firm, prepare the description of the system, and answer the evidence requests. Then we step back, because the firm that built your controls cannot be the firm that grades them.
SOC 2 compliance questions, answered straight.
Answers first, including the one where we tell you the certificate you're asking for doesn't exist. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedPIPEDA CompliancePIPEDA compliance for Canadian organisations, built to still hold when Bill C-36 replaces the Act.
- RegulatedPrivacy Impact Assessment (PIA)Privacy impact assessment for Canadian institutions and their vendors, written to the rule that actually binds them.
- RegulatedThird-Party Risk ManagementThird party risk management for Canadian organisations, covering the subcontractors and concentration OSFI B-10 asks about.
Not sure where you stand? Take the free SOC 2 readiness assessment
