SOC 2 is the de facto security attestation for SaaS companies and service organizations. Lavawall® collects Type II evidence automatically year-round. ThreeShield's CISSP/CISA team guides your readiness program and delivers the gap assessment (typically 200+ findings) that makes your formal audit predictable.
The Common Criteria are required for all SOC 2 reports. Covers logical and physical access controls, system operations, change management, and risk mitigation.
System availability commitments. Relevant for SaaS companies with uptime SLAs. Requires monitoring, incident response, and disaster recovery documentation.
Protection of confidential information. Relevant for B2B companies handling client confidential data, such as financial projections, business plans, and trade secrets.
System processing is complete, valid, accurate, timely, and authorized. Most relevant for financial processing, healthcare data processing, and payment systems.
Collection, use, retention, disclosure, and disposal of personal information aligns with AICPA's Privacy Management Framework and with PIPEDA/GDPR.
Type I: a point-in-time assessment. Are controls designed adequately as of a specific date? Type II: were controls operating effectively over an observation period (typically 6-12 months)? Enterprise clients almost always require Type II.
SOC 2 Type II requires evidence that controls operated consistently throughout the observation period. Most organizations scramble to collect this evidence in the weeks before their audit. Lavawall® collects it continuously and automatically (patch logs, MFA status, access reviews, encryption state, and backup records), so when your auditor asks, the evidence is already organized and timestamped.
Define SOC 2 scope (Trust Services Criteria, system boundary, service commitments). CISSP/CISA gap assessment against all applicable criteria. Lavawall® deployed for continuous evidence collection baseline.
Remediate critical and high findings from gap assessment. Policy and procedure development (15-25 documents typically required). Vendor management documentation. Access control implementation.
Lavawall® collects evidence continuously. ThreeShield monitors for control exceptions. Quarterly reviews confirm observation period evidence is clean and complete.
Internal control testing before formal audit. Identify and remediate any remaining gaps. Prepare evidence packages for each Trust Services Criterion.
External auditor conducts Type I or Type II assessment. ThreeShield supports the audit process and responds to auditor requests. SOC 2 report issued.
Yes. SOC 2 is an attestation engagement that must be performed by a licensed CPA firm. ThreeShield is not a CPA firm and does not issue SOC 2 reports. We prepare you for the audit and make it predictable and efficient, and then a qualified CPA auditor performs the formal assessment. We work with several audit firms and can recommend partners.
Typically $15,000-$80,000 for a Type II report from a credible CPA firm. Audit fees vary by auditor, scope, and organization complexity. ThreeShield's preparation engagement is separate and typically reduces total cost by making the audit more efficient. Organizations with Lavawall® continuous evidence collection typically see faster and lower-cost audits because evidence is already organized.
ThreeShield adds the human expertise layer: CISSP/CISA gap assessment, remediation guidance, policy development, and formal audit support. Drata and Vanta provide evidence collection for SOC 2, similar to Lavawall®. We can work alongside your existing platform or replace it with Lavawall® GRC. For Canadian-specific frameworks (Alberta HIA, CPA Canada, PIPEDA), Lavawall® provides significantly better coverage than Drata or Vanta.
Start at whatever security maturity you have today. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full readiness delivery: ThreeShield manages the entire readiness program end to end and coordinates your external CPA audit
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring so you stay compliant year-round.
Book a Scoping CallDIY · Supported · Done-for-You · Available globally