Scope and gap assessment
Define the service, systems and responsibilities in scope. Compare current controls and evidence with the applicable Trust Services Criteria, then prioritise the gaps with accountable owners.
On this pageServices & pricing
SOC 2 · Trust Services Criteria
SOC 2 Readiness for Australian SaaS & Service Providers
Aegentra helps you prepare for the SOC 2 report your customer has requested. We define the service boundary, assess gaps and organise the controls and evidence needed for an independent examination. Your proposal sets out the work we will deliver, what your team will own and any separately priced implementation or ongoing support.
SOC 2 readiness from A$7,500 + GST
For a small, straightforward scope with existing controls. Independent CPA examination fees and software subscriptions are separate.
See the starting packageTeams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.
03 9956 9399
- Written scope and responsibilities
- Practical control and evidence support
- Independent CPA examination
SOC 2 services
The support you need, with the scope clear from the start
Start with the report your customer will accept and the controls you already operate. Aegentra can support a focused readiness engagement or a wider implementation programme. The starting package below is for a small, established environment; additional technical work and ongoing support are quoted separately.
Control and policy implementation
Translate agreed gaps into practical policies, procedures and technical changes. Where hands-on engineering or implementation is required, the proposal identifies the work, delivery responsibilities and additional fee.
Evidence and Type II preparation
Plan the records needed to show how controls operate: access reviews, change approvals, incident records, supplier reviews and other evidence relevant to the system. Support throughout a Type II reporting period is separately scoped.
CPA coordination and audit preparation
Prepare for the independent CPA firm's information requests and hand over the agreed readiness outputs. Extended fieldwork liaison, additional remediation and later examinations are available under a separate scope.
SOC 2 readiness starting package
From A$7,500 + GST
Excluding GST; an Australian billing address adds 10% GST at invoicing.
For a business with up to 10 staff, one legal entity, one clearly bounded service and a straightforward cloud environment. The package assumes existing core security controls and an internal owner who can complete agreed actions. It is based on a Security-category scope only where that scope meets the actual assurance requirement. A wider requirement needs a wider quote.
Included in the agreed readiness scope
- A scoping workshop and gap assessment.
- A control-to-evidence map and prioritised action plan.
- Tailoring of the policies agreed in the proposal.
- Support preparing the system description.
- One pre-audit readiness review.
- One handover meeting with your appointed CPA firm.
Quoted separately or supplied by other providers
- The independent CPA examination and SOC 2 report.
- Software subscriptions and penetration testing.
- Substantial technical remediation, code changes or building controls from scratch.
- Additional entities, services, criteria or complex environments.
- Ongoing Type II evidence-period support and extended audit liaison.
- Further review cycles or remediation beyond the agreed scope.
We confirm deliverables, review rounds, responsibilities, dependencies and the fixed fee in writing before work begins. Readiness support does not guarantee a particular audit opinion, report date or customer contract.
Discuss the starting packageThe report and your buyer
SOC 2 is a report, not a certificate
SOC 2 is an independent examination of a service organisation's system and controls against relevant AICPA Trust Services Criteria. A licensed CPA firm issues the report; Aegentra provides readiness and preparation services. A report may help answer a customer's assurance questions, but the customer still decides whether its scope, reporting period and findings meet their requirements.
Before commissioning work, ask your buyer which service must be covered, whether they require Type I or Type II, which categories they expect and how recent the report must be. A report covering the wrong product or period may not satisfy procurement, even when it contains an unmodified opinion.
- Aegentra
- Readiness and agreed implementation support.
- Your organisation
- Owns and operates its controls.
- Independent CPA firm
- Examination and report.
- Your customer
- Decides whether the evidence meets its requirements.
Report choice
Type I or Type II: follow the assurance requirement
Agree the intended report with your customer and CPA firm before setting the project plan. Type I and Type II answer different questions. A Type I report is not a mandatory first step and should not be sold as a substitute when a buyer requires Type II.
Conceptual comparison — not a delivery timetable.
Type I — at a specified date
Examines the system description and whether controls are suitably designed at a specified date. It does not provide an opinion on operating effectiveness throughout a reporting period.
Type II — over a specified period
Also examines whether controls operated effectively over a specified period. Your team needs to operate the controls and retain appropriate evidence throughout that period.
The reporting period and examination timetable are agreed with the CPA firm. Readiness, technical remediation, control operation and the firm's availability are separate parts of the schedule. Repeat examinations may be arranged to meet ongoing customer requirements; they are not a certification renewal.
What does a bridge letter do?
A management bridge letter may describe relevant changes after a report's period ends. It does not extend the CPA firm's examination or provide a new audit opinion. Ask the intended recipient what assurance it will accept.
Trust Services Criteria
Scope the service your customer actually uses
The Common Criteria apply across the Trust Services Categories. Additional criteria apply when Availability, Confidentiality, Processing Integrity or Privacy are included. We help define the categories, service commitments and system requirements relevant to the engagement, rather than selecting a scope solely to achieve a lower fee.
The boundary should identify the relevant service, infrastructure, software, people, procedures, data and outsourced dependencies. Agree how subservice organisations are treated and what complementary controls customers or other providers must operate. These decisions affect evidence requirements, the CPA firm's work and whether the final report answers the buyer's question.
Explore the criteria
Open a category to see what it covers. This diagram explains the categories; it does not select your engagement scope.
Your serviceAgreed assurance scope
Security
Protection against unauthorised access, use or disclosure; evaluated using the Common Criteria.
Availability
Whether the system is available in line with its commitments and requirements.
Confidentiality
Protection of information designated as confidential.
Processing Integrity
Complete, valid, accurate, timely and authorised processing.
Privacy
Personal-information practices within the agreed privacy scope.
How we work
From a buyer requirement to a usable evidence pack
Good readiness work connects each requirement to a control, an accountable owner and evidence of what actually happens. We record gaps and dependencies early, so your team knows what must change before the independent examination. The starting package covers the agreed preparation outputs; hands-on technical work and support throughout an observation period need their own scope.
Define
Confirm the service boundary, intended report, criteria and buyer requirements.
Assess
Review existing controls, policies and evidence; agree priorities and owners.
Prepare
Tailor agreed documentation and map evidence. Complete technical remediation through the responsible team or a separately scoped Aegentra service.
Review
Carry out the agreed readiness review and identify outstanding actions. For Type II, plan ongoing control operation and evidence with the CPA firm.
Hand over
Provide the agreed readiness outputs to the appointed CPA firm. The firm determines its examination procedures and conclusions.
Where Aeges can help
Where included in scope, Aeges can support the organisation of evidence from supported Microsoft 365 sources. Other systems, people, policies and supplier controls need other evidence. A tool does not establish that every control is effective, replace management's responsibilities or determine the CPA firm's opinion.
/ Delivery team
Who will deliver your SOC 2 readiness engagement?
The readiness scope identifies the accountable lead, the systems and controls inside scope and any technical contribution required to prepare evidence for the independent examination.
- ResponsibilityAccountable delivery
- Assigned roleSOC 2 readiness lead
- How it is confirmedThe named lead, scope, deliverables and client responsibilities are agreed in writing.
- ResponsibilityTechnical contribution
- Assigned roleControl or system specialist, where required
- How it is confirmedThe specialist function and evidence responsibility are recorded in the scope.
- ResponsibilityExamination boundary
- Assigned roleIndependent CPA firm
- How it is confirmedAegentra provides readiness support. The independent practitioner performs the examination and issues the SOC report.
Qualified delivery matched to your scope
Our team combines implementation, audit, security-governance and technical expertise. Across their professional careers, team members have delivered 2,000+ hours of ISO, ISM and GRC audit work across 70+ organisations.
Team qualifications and credentials
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Management systems and audit
- ISO/IEC 27001 Lead Implementer
- ISO/IEC 27701 Lead Implementer
- PECB ISO/IEC 27001 Lead Auditor
- ISO/IEC 42001 Lead Auditor
- CISA — Certified Information Systems Auditor
- ISM Auditor
Cybersecurity and cloud
- CISSP — Certified Information Systems Security Professional
- CISM — Certified Information Security Manager
- Certificate of Cloud Security Knowledge (CCSK)
- OSCP+ — OffSec Certified Professional Plus
Service delivery and specialist training
- ITIL Expert
- PRINCE2
- Mastering Generative AI for Cybersecurity Certificate
- Essential Eight Assessment Course certificate — TAFEcyber
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
The people assigned to your engagement—and the experience and qualification evidence relevant to their roles—are confirmed in your proposal before work begins.
Readiness support does not guarantee an examination result. The assigned roles and evidence responsibilities are confirmed for the agreed scope.
Independent examination
Aegentra prepares. An independent CPA firm examines.
Your organisation appoints the CPA firm that will examine the system and issue the SOC 2 report. We can work with your existing firm and provide the coordination included in your proposal. The firm retains responsibility for its independence, examination procedures, assessment of evidence and opinion.
Budget separately for readiness support, any technical remediation or software, and the CPA examination. Report type, system complexity, selected categories, the reporting period and the quality of available evidence can affect the overall cost. The A$7,500 starting fee is a readiness fee, not an all-inclusive report price.
Findings and exceptions must be represented accurately. Addressing a problem does not erase a historical exception or determine how the CPA firm reports it. Extended fieldwork support and further remediation are agreed separately.
See the readiness package and exclusionsConnected assurance work
Already operating an ISO 27001 ISMS?
Existing access reviews, risk assessments, supplier reviews, change approvals and incident records may support SOC 2 preparation. We assess their relevance to the actual service boundary and reporting period before reusing them. ISO 27001 certification does not automatically satisfy SOC 2, and a SOC 2 report does not replace an ISO 27001 certificate.
| Existing practice | What to check for SOC 2 |
|---|---|
| Access reviews | The systems, populations, owners and dates match the report scope. |
| Change management | Approvals, testing and release records cover the relevant service. |
| Supplier management | Dependencies, responsibilities and relevant supplier assurance are identified. |
| Incident management | Records demonstrate the process used during the applicable period. |
At a glance
- Aegentra's role
- Readiness and the implementation support agreed in your proposal.
- Report issuer
- Your appointed independent licensed CPA firm.
- Scope
- The agreed service boundary, criteria and report type.
- Timing
- Confirmed after readiness, evidence and CPA availability are reviewed.
- Delivery
- Remote-first across Australia; other arrangements confirmed in the proposal.
Questions buyers ask
SOC 2, clearly answered.
What does SOC 2 readiness cost?
Aegentra's starting package is A$7,500 + GST for the small, defined scope described above. The final fixed fee follows a scope review. The independent CPA examination, software and work outside the agreed package are separate costs.
Does the starting price include the SOC 2 report?
No. The CPA firm's examination and report are separate. Aegentra prepares your organisation and provides the outputs and coordination agreed in your proposal.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued following an independent examination. People sometimes call it “SOC 2 certification”, but the report, its scope, period and opinion are what buyers need to assess.
Do we need Type I before Type II?
Not necessarily. Start with the report your buyer needs and agree the approach with the CPA firm. Type I considers a specified date; Type II also considers operating effectiveness over a specified period.
How long will it take?
The plan depends on the starting control environment, remediation, evidence availability and the intended examination. For Type II, the agreed reporting period is separate from preparation work. We do not promise a report date before these dependencies and the CPA firm's availability are understood.
Can you implement controls as well as advise?
Yes, where that work is included in the written scope. The starting readiness package assumes existing core controls and an internal owner for agreed actions. Substantial technical changes, new controls and ongoing evidence-period support are quoted separately.
Can we use our existing ISO 27001 work?
Often, relevant controls and evidence can be reused after their scope and suitability are checked. There is no universal overlap percentage and neither assurance output automatically replaces the other.
Can we work with our own CPA firm or compliance platform?
Yes. We agree the responsibilities and evidence workflow around the tools and CPA firm you appoint. The firm determines what it needs for the examination; a platform does not replace control operation or independent judgement.
Is SOC 2 the same as SOX?
No. SOC 2 concerns controls relevant to a service organisation's agreed system and criteria. SOX concerns financial reporting and related obligations for organisations within its scope. Aegentra offers SOX / ITGC readiness separately.
Can our own team run readiness?
Yes, if it has the capacity and relevant skills. You can retain ownership internally and engage Aegentra for defined gaps. Professional training is available separately through Aegentra Academy; buying a course does not provide your organisation with a SOC 2 report.
How do we define the SaaS service boundary for SOC 2 readiness?
Identify the service your customers rely on, its commitments and the people, systems, data and dependencies supporting it. Work with the appointed CPA firm to establish the examination scope and criteria. A cloud hosting account alone is not the whole service boundary. Explain material suppliers, customer responsibilities and exclusions so the eventual report addresses the intended buyer’s assurance question.
Does our cloud provider’s SOC report mean our own service is covered?
No. The provider’s report concerns its defined system, period and criteria, not automatically your application or controls. Review the report’s relevance, exceptions and responsibilities expected of customers. Your organisation must address its own access, configuration, development, operations and other relevant controls. Aegentra’s readiness work can organise those dependencies; the independent CPA firm determines its examination requirements.
How should we handle an exception during a SOC 2 Type II evidence period?
Record the exception, its context, impact assessment and response rather than removing it from the evidence set. Retain the original records and subsequent corrective action. Discuss the implications with the CPA firm, which evaluates the evidence and forms the examination opinion. An exception is not something a readiness consultant can promise to erase, and a later fix does not rewrite what happened during the reporting period.
Let's talk
Tell us what your customer needs
Share the service to be covered, the report requested, your current controls and any customer deadline. We will discuss the right scope and the information needed for a written proposal.