A buyer-grade security posture
Answers to the top 30 questionnaire items pre-written. A trust page worth linking to. Procurement reviewers stop being a blocker.
SOC 2 readiness
Stop losing enterprise deals to a missing SOC 2.
We build SOC 2 readiness the way a founding team can actually run it — focused on the controls that matter, the evidence auditors trust, and the answers your buyer's security review is waiting for.
- Buyer-grade control design — not a 200-page policy theatre pack.
- Evidence rituals that survive past the audit window.
- Auditor introductions to firms that work at your stage.
- SOC 2 Type I & II
- NIST CSF aligned
- EU + US auditors
- Fixed scope, fixed fee
When this is for you
If any of these sound familiar, we can help.
-
Your sales pipeline is jamming on security questionnaires.
Enterprise buyers — banks, healthcare, government primes — won't move past procurement without a SOC 2 report. Each deal stalls for weeks while you draft answers from scratch.
-
You promised SOC 2 by Q-something and the deadline is closing.
An investor, a board, or a strategic customer set a date. You need a credible plan that hits it without burning the engineering roadmap.
-
You started with a compliance-automation tool and stalled.
The dashboard is green on paper but you're not sure which controls actually work, which evidence is real, and what an auditor will accept. We pick the program up where the tool runs out.
-
Your last audit surfaced findings and you need them closed before the next one.
We come in, scope the gap, fix the underlying causes — not just the symptoms — and hand the rebuilt controls back to a team that can sustain them.
The engagement
Three phases. Predictable cadence.
No mystery process. Each phase has a defined output, a fixed timebox, and a single owner on our side.
- 01
Scope & gap assessment 2–3 weeks
We map your systems, data flows, and existing controls to the Trust Service Criteria you actually need (most startups are Security + sometimes Confidentiality). You leave with a prioritized gap list, a realistic timeline to Type I or Type II, and a fixed-fee proposal for the next phase.
- 02
Control design & operationalization 6–10 weeks
Policies, procedures, technical controls, vendor inventory, evidence rituals — designed with engineering so they survive in production. We embed in your tools (Notion, Drata/Vanta, Linear, GitHub) instead of creating a parallel paper trail.
- 03
Auditor handover & first observation 2–4 weeks
We introduce two or three vetted auditors, support the kickoff, sit in the walkthroughs, and stay on retainer through the observation window so questions get answered the same day.
Outcomes
What you'll have when we're done.
Controls your team can actually run
Evidence captured as a by-product of how you already work, not a quarterly fire drill. No "audit week" panic.
A clean attestation report
Either a SOC 2 Type I or a Type II report from an independent CPA, with the underlying program ready to extend to ISO 27001 or PCI-DSS when the next buyer asks.
An operating muscle, not a project
A documented rhythm — access reviews, vendor reviews, incident drills, board reporting — that your next hire steps into instead of rebuilds.
From the practice
"SOC 2 only matters because your customers care. Build the program for them — for the procurement reviewer at the bank, the security lead at the hospital — and the report writes itself. Build it for the audit and you'll be back here next year."
— Adam Gresh, Purple Dragon Cybersecurity
Frequently asked
Common questions, direct answers.
How long does a SOC 2 readiness engagement take?
For a 10–50 person SaaS company starting close to zero, plan on 8–14 weeks of readiness work before observation begins. Type I attestation typically follows within 1–2 months after that; Type II adds a 3–12 month observation window.
Do you actually run the audit?
No. We prepare your environment, controls, and evidence so an independent CPA firm can attest cleanly. We work with several Big-4 and boutique auditors and can introduce you to firms that match your stage and budget.
Do we need a full-time security person to keep this running?
Not at the start. We design controls that match what your team can actually operate, document the rituals, and (if useful) cover the security-leadership seat ourselves on a fractional basis until you hire.
What does this cost?
Readiness engagements are fixed-scope, fixed-fee based on environment size and the gap to baseline. A 30-minute call gets you a realistic range — not a brochure quote.
Get a 30-min scoping call
No deck. No pitch. A working session on what your SOC 2 path actually looks like.
Talk to a security operator.
Tell us what you're trying to ship, what's stalled, or which buyer security review is up next. We work with companies across the EU, EEA and US — and we reply within one business day.
- info@purpledragoncyber.com
- +31 10 899 8719
- Nicolaas Beetsstraat 216, 3511 HG Utrecht