SOC 2 readiness for UK software companies
A US customer has asked for your SOC 2 report and you don't have one yet. We find what's missing, fix it in your app, cloud and policies, and get you ready for an independent auditor.
We build and run software ourselves, so the fixes get made rather than listed. You choose the auditor; we do the work that gets you through the audit.
Where you stand and what it will take
Bring the customer's request, if you have it, and a rough picture of your product and hosting.
Why you're being asked for SOC 2
SOC 2 is how US companies check that a supplier looks after their data. UK software companies usually meet it the first time a large US customer reaches procurement.
A US customer wants your report
Enterprise buyers in the US often ask for a SOC 2 report before they sign or renew, especially when you will hold their customers' data.
Security questionnaires keep coming
A current SOC 2 report answers most vendor security questionnaires in one document, so deals stop waiting on spreadsheets.
Investors or a buyer are checking
Due diligence asks how you control access, changes and customer data. Readiness work gives you written answers and evidence.
What SOC 2 is, in plain terms
SOC 2 is a report, not a certificate. An independent CPA firm audits your controls against the AICPA's Trust Services Criteria and writes an opinion your customers can read. Security is always included; availability, processing integrity, confidentiality and privacy are added when your customers need them.
Type I
Checks that your controls are designed properly on a single date. Quicker to get, and often enough to keep a deal moving.
Type II
Checks that the controls worked over a period, typically six to twelve months and rarely less than three. This is the report most enterprise customers ask for in the end.
We aren't a CPA firm and can't issue SOC 2 reports. Your auditor can't design the controls it later tests, which is why readiness work is done separately. We get you ready, help you choose an auditor and work alongside them until the report is issued.
How readiness works
Most of the effort goes into changing how your systems and team work, then keeping evidence that they do.
Scope
We agree which products, systems and people are in scope, which Trust Services Criteria your customers need, and whether to start with Type I or go straight to Type II.
Gap assessment
We check your app, cloud, code repositories, laptops, suppliers and policies against the criteria, then give you a ranked list of gaps with a plan and timeline.
Fix
We make the changes in your systems and write the policies to match what you actually do. Your team signs off anything that touches production.
Evidence and audit
We set up evidence collection, in a compliance platform or something lighter, run a mock audit, then help you answer the auditor's requests.
The gaps we fix most often
Across 75 SOC 2 audits reviewed by Lazarus Alliance, a CPA firm, access control problems turned up in 51%, change management in 41% and logging and monitoring in 37%. These are the areas we change in your systems, not just describe in a report.
Access
Shared logins, no MFA on cloud consoles, leavers who keep access for days and no record of access reviews.
Changes to production
Code reaching production without review, and no record of who approved a change or why.
Logging and alerts
Logs that aren't kept long enough, or nobody alerted when something suspicious happens.
Risk and suppliers
No written risk assessment, no list of the suppliers that handle customer data and no check of their security.
Vulnerabilities
Dependencies and servers patched when someone remembers, with no scanning and no deadline for fixing what is found.
Incidents and recovery
An incident plan that has never been tried, and backups that have never been restored in a test.
What it costs and how long it takes
SOC 2 has three costs: the auditor's fee, a compliance platform if you use one, and the readiness work. We quote the readiness work after the first call, once we know your scope.
Median price buyers pay for Vanta or Secureframe. A platform is optional.
Vendr pricing data ↗We build and run software ourselves
Vu builds, hosts and secures software for UK businesses, and runs its own AI platform, Raq.com. The controls an auditor looks for are ones we keep on our own systems every day.
Vu is Cyber Essentials certified, and our security work covers code review, penetration testing and hosting.
How we handle security ↗Penetration testing as part of readiness
Customers often ask for a recent penetration test alongside SOC 2, and auditors look at how you find and fix vulnerabilities. We can test your app and fix the findings in the same engagement, or arrange an accredited tester if a customer requires one.
Penetration testing ↗SOC 2 questions
What is SOC 2 readiness?
A check of how your current controls measure up to the SOC 2 Trust Services Criteria, followed by the work to close the gaps before an auditor tests them.
Is SOC 2 mandatory in the UK?
No UK law requires it. Companies need it when a customer, usually in the US, makes a SOC 2 report a condition of buying.
Is SOC 2 the same as ISO 27001?
No. SOC 2 is an attestation report from a CPA firm, renewed every year. ISO 27001 is a certificate from a certification body on a three-year cycle with yearly surveillance audits. The controls overlap a lot, so work for one helps with the other. UK and EU buyers often accept ISO 27001, while US enterprise buyers usually ask for SOC 2.
Type I or Type II: which do we need?
Ask the customer what they will accept. A Type I shows your controls are designed properly on one date and can keep a deal moving. Most enterprise customers want a Type II in the end, because it shows the controls worked over a period.
How long does SOC 2 take?
Readiness usually takes one to three months, depending on how much needs to change. A Type I audit can follow straight after. A Type II needs an observation period, usually at least three months, then two to six weeks for the auditor to write the report.
How much does SOC 2 cost?
There are three parts: the auditor's fee, a compliance platform if you use one, and the readiness work. UK Type II audits for startups commonly cost £15,000 to £35,000. Platform prices aren't published, but buyers' data puts the median for Vanta and Secureframe at about $20,000 a year. We quote the readiness work after the first call.
Can you issue our SOC 2 report?
No. Only an independent, licensed CPA firm can, and the auditor can't design or put in place the controls it later tests. We do the readiness work and support you through the audit with the firm you choose.
Do we need Vanta or Drata?
Not necessarily. A platform automates evidence collection and saves time, but auditors accept evidence from any well-run system. We'll recommend one if it saves you more than it costs, and set it up if you go ahead.
What are the five Trust Services Criteria?
Security, availability, processing integrity, confidentiality and privacy. Only security is required. Add the others when your customers need them.
How long is a SOC 2 report valid?
There is no formal expiry date, but most customers won't accept a report whose period ended more than 12 months ago, so companies renew every year.
Is SOC 2 changing?
The AICPA published a draft of updated Trust Services Criteria on 28 October 2026, including new points of focus on AI. If approved, the update applies to engagements beginning on or after 31 December 2027.
Book a readiness call
Tell us who has asked for SOC 2, what your product does and where it's hosted. We'll reply to arrange a call at a time that suits you.
You'll speak to Phil or Alex
Vu's founders. Whoever replies stays with your project throughout.