SOC 2 READINESS
SOC 2 readiness in Houston, without the guesswork
DESSS is a Houston-based IT consulting firm that helps SaaS companies, managed service providers, and data processors across Houston, Austin, and the rest of Texas get ready for SOC 2. We handle scoping, gap assessment, remediation, policy writing, and evidence readiness, and support remote teams across the United States.
SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines your controls against the Trust Services Criteria and issues a report your customers can rely on during security reviews.
DESSS does not issue SOC 2 reports, and that independence matters to your auditor. Our role is the work before and during the audit: scoping, gap assessment, remediation, policy writing, and evidence readiness, so the examination confirms controls that already work.
Who needs SOC 2 in Houston
SaaS providers, managed service and IT providers, data processors, and any vendor whose customers ask for an independent security report.
Who issues the report
Only a licensed CPA firm can issue a SOC 2 report. We prepare you for the examination and work alongside your auditor.
Typical timeline
Readiness depends on your starting point. A Type II report adds a review period, commonly three to twelve months.
Required criteria
Security is mandatory. The other four categories are added only when they match commitments you make to customers.
SOC 2 consulting for Houston and Texas businesses
Houston companies in healthcare, energy, finance, and software often face SOC 2 requests from enterprise customers during vendor security reviews. DESSS works with your team to confirm which Trust Services Criteria apply, fix control gaps, and build an evidence library before your auditor starts fieldwork.
- Houston-based team, available for scoping workshops and walkthroughs
- Remote delivery for teams across Texas and the United States
- Controls built on Microsoft 365, Azure, and AWS
WHAT SOC 2 EXAMINES
What a SOC 2 audit looks at
The auditor tests your controls against the Trust Services Criteria and reviews how you describe your system. These are the areas where readiness work usually concentrates.
System description
A written description of the services, infrastructure, software, people, data and procedures in scope, including the boundaries of the system.
Control environment
Governance, board or leadership oversight, HR practices, security responsibilities and the code of conduct that sets the tone for every other control.
Logical access
User provisioning and removal, MFA, privileged access and periodic access reviews across production systems and SaaS tools.
System operations
Vulnerability management, logging, monitoring and incident response that detect and handle security events.
Change management
How code and infrastructure changes are requested, reviewed, approved, tested and deployed.
Risk and vendors
A documented risk assessment and a process for reviewing the security of the vendors and subservice organizations you rely on.
TRUST SERVICES CRITERIA
The Trust Services Criteria, explained
Choose the categories that match what you promise customers. Adding criteria you do not need lengthens the audit without improving the report.
Security (common criteria)
What does the security category cover? Security is the baseline for every SOC 2 report. Its common criteria cover the control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation.
We map each criterion to the specific controls you run, so nothing is left to interpretation at fieldwork.
–Access provisioning and removal
–MFA and privileged access
–Vulnerability and patch management
–Incident response
–Change approval and testing
Availability
When should availability be in scope? Include availability when customers rely on uptime commitments or SLAs. It covers capacity planning, backups, recovery and the testing that proves you can restore service.
Our disaster recovery design and testing work produces the recovery test evidence auditors expect.
–Capacity and performance monitoring
–Backup and restore testing
–Disaster recovery plans
–Environmental and infrastructure protections
Processing integrity
What is processing integrity? Processing integrity applies when your system processes transactions or data for customers, such as payments, payroll or claims, and you commit that processing is complete, valid, accurate and timely.
–Input validation
–Processing monitoring and error handling
–Output reconciliation
–Data quality controls
Confidentiality
How is confidentiality different from privacy? Confidentiality protects information designated as confidential, such as customer business data or intellectual property, from collection through disposal. Privacy covers personal information specifically.
We often implement Microsoft Purview data loss prevention and sensitivity labels to support this category.
–Data classification
–Encryption at rest and in transit
–Retention and secure disposal
–Data loss prevention
Privacy
When is the privacy category needed? Privacy is added when you collect, use, retain or disclose personal information and make commitments about it. It covers notice, consent, access, disclosure and quality of personal information.
–Privacy notice and consent
–Data subject access requests
–Disclosure to third parties
–Retention and disposal of personal data
HOW WE WORK
How a SOC 2 readiness engagement runs
Six steps take you from scoping to an audit-ready control set, then support you through the review period.
STEP 01
Define scope
Agree the services, systems, locations and Trust Services Criteria in scope, and identify subservice organizations such as your cloud provider.
STEP 02
Assess the gaps
Compare current controls to the criteria through interviews, configuration reviews and sample evidence.
STEP 03
Remediate
Close gaps in identity, logging, change management, vendor review and policy, prioritized by audit risk.
STEP 04
Document
Write or update policies and procedures, and draft the system description your auditor will review.
STEP 05
Organize evidence
Set up repeatable evidence collection and run a mock request list before the auditor arrives.
STEP 06
Support the audit
Help select an auditor, respond to requests during fieldwork and keep controls operating through the Type II period.
WHY DESSS
Why work with DESSS on SOC 2
A readiness partner should leave you with controls your team can run without us. That is how we approach every engagement.
Implementation, not just advice
Our engineers configure the identity, endpoint and monitoring controls, rather than handing you a list of findings.
Independent from your auditor
We prepare you for the examination and do not issue the report, which keeps the auditor’s independence intact.
Controls that fit your stack
We work with Microsoft 365, Azure, AWS and the SaaS tools you already use, instead of adding tools for the sake of the audit.
Support after the report
Ongoing virtual CISO advisory keeps controls operating for the next review period.
SOC 2 is an AICPA attestation framework. An independent CPA firm examines a service organization’s controls against the Trust Services Criteria and issues a report that customers use to assess the organization’s security.
A Type I report evaluates whether controls are suitably designed at a single point in time. A Type II report also tests whether those controls operated effectively over a review period, commonly three to twelve months.
No. SOC 2 results in an attestation report with an auditor’s opinion, not a certificate. Only a licensed CPA firm can perform the examination and issue the report.
Security is required in every SOC 2 report. Add availability, processing integrity, confidentiality or privacy only when they match commitments you make to customers.
It depends on scope and how mature your controls are today. A gap assessment gives you a realistic plan. For Type II, the review period comes after readiness and typically lasts three to twelve months.
SOC 1 covers controls relevant to customers’ financial reporting. SOC 2 covers security and the other Trust Services Criteria. SOC 3 is a shorter, general-use version of a SOC 2 report that can be shared publicly.
No. DESSS prepares your organization for the audit and supports you during it. The examination itself must be performed by an independent licensed CPA firm.
Yes. DESSS is based in Houston and prepares companies across Houston and Texas for SOC 2 Type I and Type II examinations. We do not perform the audit itself; an independent CPA firm does.
Cost depends on scope, number of Trust Services Criteria and current control maturity. A gap assessment gives a fixed plan and estimate. Book a scoping call to get one.
SOC 2 READINESS
Get SOC 2 audit-ready in Houston
Start with a scoping call. We will confirm which criteria apply and what stands between you and a clean report.
RELATED
Related Compliance and Security Pages
Other compliance frameworks we support, and the DESSS security services that produce the evidence auditors ask for.