Title: SOC 2 readiness > SOC 2 readiness for UK service organisations: define the scope, select and operate the controls and assemble the evidence for an independent SOC 2 examination. Source: https://aegentra.co.uk/services/govern/soc-2 Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Govern / United Kingdom # SOC 2 readiness Prepare a service organisation’s scope, controls and evidence for an independent SOC 2 examination. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=SOC%202%20readiness) [See a working example](https://aegentra.co.uk/services/govern/soc-2#working-example) Does your customer need a SOC 2 report—or something else? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=SOC%202%20readiness) The requirement in context ## Define the requirement before selecting the work. Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report. Primary references [AICPA: SOC suite of services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) Inside the work ## Does your customer need a SOC 2 report—or something else? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Customer request | Confirm the required report and intended recipient. | The actual procurement wording and acceptance conditions. | | Service boundary | Identify the service, infrastructure, people and dependencies. | A system description aligned to the agreed examination. | | Operating evidence | Define who retains which records and for what period. | Evidence owners, schedules and remediation tracking. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-soc-2-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Prepare a service organisation’s scope, controls and evidence for an independent SOC 2 examination. - Customer requirement and reporting-scope review - System description and control ownership support - Evidence and readiness-gap review - Remediation and examination-preparation support ### Separate responsibilities Aegentra readiness work does not issue a SOC 2 report. The independent examining CPA firm, its fees, opinion and reliance decisions are separate. How the work moves forward ## From the requirement to a usable result. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Understand the requirement Define the product, service, process and relevant external requirement. - ### Build the record Assign responsibilities and connect decisions to operating evidence. - ### Review and improve Check what is working, address gaps and agree the next review. A practical starting point ## Does your customer need a SOC 2 report—or something else? Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report. Fictional working exampleCustomer request — Confirm the required report and intended recipient. — The actual procurement wording and acceptance conditions. Service boundary — Identify the service, infrastructure, people and dependencies. — A system description aligned to the agreed examination. Operating evidence — Define who retains which records and for what period. — Evidence owners, schedules and remediation tracking. Before you commission the work ## Your questions. Clear answers. **Does your customer need a SOC 2 report—or something else?** Confirm the requested report, service boundary, criteria and period with the customer and examining firm. SOC 2 is an assurance reporting engagement, not an ISO certificate. Training a person as a Lead SOC 2 Manager does not produce an organisational SOC 2 report. **What is included in the engagement?** Customer requirement and reporting-scope review; System description and control ownership support; Evidence and readiness-gap review; Remediation and examination-preparation support. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** Aegentra readiness work does not issue a SOC 2 report. The independent examining CPA firm, its fees, opinion and reliance decisions are separate. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **Do you issue a SOC 2 certificate?** No. SOC 2 is an independent CPA attestation engagement and report, not an ISO certificate. Aegentra’s service is scoped readiness support. Agree the required report type, system boundary and customer expectations with the independent CPA firm. **Can a compliance platform replace a SOC 2 examination?** No. It can help organise evidence and workflows, but the independent service auditor evaluates the examination evidence. Dashboard completion and integration coverage do not establish that every relevant control operated over the reporting period. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. ## Resources for this decision. [SOC 2 Type 1 vs Type 2: a UK buyer’s guide](https://aegentra.co.uk/knowledge/soc-2-type-1-vs-type-2) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) [Microsoft 365 security assessment](https://aegentra.co.uk/services/harden/microsoft-365-security-assessment) [AIUC-1 readiness for AI agent vendors](https://aegentra.co.uk/services/govern/aiuc-1) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)