Skip to content
Scope, price and timeline published on every engagement page Engineers assigned within 3 working days of kickoff Your repositories, cloud accounts and licences stay in your name
UniStack.
Security & Compliance Fixed scope

SOC 2 Evidence Groundwork

The technical controls and evidence collection an SOC 2 Type II audit needs, set up before the observation window starts.

Delivered in

30 working days

Revisions

One round, included

Ownership

Yours from day one

Overview

What this engagement is

SOC 2 fails on evidence, not on intentions. Auditors want to see that access reviews happened, that changes were approved, that backups were restored and logs retained, over a period of months. Retrofitting that after the window has started is painful. We implement the technical controls first: automated access reviews, change management through pull requests, centralised logging with retention, vulnerability management with SLAs. Evidence collection is automated where possible so your team is not screenshotting consoles the week before the audit.

Deliverables

What lands in your repositories

7 items
  • Control gap assessment against the Trust Services Criteria you are scoping
  • Access review process automated with quarterly evidence generation
  • Change management enforced through pull request approvals and audit trail
  • Centralised logging with retention meeting audit requirements
  • Vulnerability management workflow with severity-based SLAs
  • Backup, restore and disaster recovery testing with documented evidence
  • Evidence collection runbook mapped control by control

Outcomes

What changes once it ships

Evidence accumulates automatically instead of being reconstructed

The observation window starts with controls already operating

Fewer auditor findings, which means a shorter and cheaper audit

Process

How the 4 stages run

  1. 01

    Assess

    current controls compared against the criteria in scope

  2. 02

    Implement

    technical controls built and integrated with your existing tooling

  3. 03

    Automate

    evidence collection scheduled so it accumulates without manual effort

  4. 04

    Rehearse

    a mock evidence request run as an auditor would issue it

Booked most often by

  • Companies whose enterprise deals are stalling on a security questionnaire
  • Startups starting an SOC 2 Type II observation window
  • Teams using a compliance platform but with no one to do the engineering

What we need from you

  • Administrative access to cloud, identity and code repositories
  • A named compliance owner on your side
  • Your chosen auditor or compliance platform, if one is already selected

These are collected in the technical brief that opens in your dashboard the moment payment clears. The clock starts when they arrive, not before.

Answers

Questions this engagement raises

No. Audits must come from a licensed CPA firm. We prepare you and work alongside whichever auditor you choose.

The technical controls overlap heavily. ISO also needs an ISMS and management system documentation, which we scope separately.

Type II needs a three to twelve month observation window after controls are operating. This work shortens the run-up, not the window.

This is engineering work, not a physical product — nothing ships and there is no stock to run out of. Delivery is to the working days stated above, into systems you control, and the refund terms set out what happens if we miss the date.

Booked alongside

Engagements that pair with this one

All Security & Compliance
Security & Compliance Most booked

Web Application VAPT

A manual penetration test of your web application with proof-of-concept evidence and a retest after you fix.

Manual penetration test covering authentication, authorisation and business logic
12 working days Scope published

Fixed fee · GST incl.

₹29,999

Read the scope

GST included

₹44,999

Capacity open this month

Read the scope. Know the price. Start on Monday.

No discovery calls to find out a number, no statements of work that take three weeks to sign. Pick the engagement that matches the problem and we assign the engineers.

Browse engagements Scope it with us