SOC 2 readiness without slowing delivery

SEYA Group prepares delivery teams for a SOC 2 examination: we compare your controls to the Trust Services Criteria you and your auditor select, map the gaps, and help collect evidence from the systems that already ship code. SEYA does not perform the SOC 2 examination and does not issue the report. The auditor does. The work is led from our Vancouver office and is scoped so the pipeline keeps releasing while evidence is gathered.

Who this is for

CTOs and security leads whose next enterprise contract asks for a SOC 2 report and whose controls still live in a spreadsheet. Teams that have the cloud accounts and the pipeline, and need someone who can point at the control in the system rather than rewrite the policy binder. Companies that already have an auditor picked, or that need the gap list before they pick one.

What you get

• A gap assessment. The criteria in scope (security is the usual start; availability, confidentiality, and the others only if you and the auditor include them), what you already do, and what is missing. The criteria are the AICPA Trust Services Criteria. SEYA is not a CPA firm and does not sign an opinion.
• Control mapping. Each gap tied to a control you can run: identity reviews, change management in the pipeline, logging, vendor access, and incident notes. Where a control is already a DevSecOps check, we use that check as the evidence source instead of adding a parallel process.
• Evidence collection. A list of artefacts, where they come from, and who exports them. Automation means a query or a pipeline record, not a new tool you must buy from SEYA. Manual evidence stays manual when that is the honest source.
• Auditor hand-off. The gap list, the control map, and the evidence index in a form your auditor can sample. We will sit in the hand-off meeting. We will not speak as your auditor.

How an engagement runs

• Confirm the criteria. You, and your auditor if you have one, name the categories and the period. We do not widen the scope to every framework on a slide.
• Read the systems. Accounts, pipeline, identity, and the policies you already published. Cloud configuration gaps found here can continue as a posture review if the fix is engineering work rather than a document.
• Close gaps that are in scope. Policy text where the gap is a missing policy. A pipeline or account change where the gap is a missing control. Delivery does not stop for a rewrite of every standard.
• Hand the index to the auditor. You own the relationship. SEYA's name on the evidence is as the party that helped assemble it, not as the examiner.

What you need in place

An executive who can pick the criteria, access to the systems that would produce evidence, and a decision about whether an auditor is already engaged. If the goal is a certificate SEYA can stamp, this service is the wrong one: we will not provide that stamp.

On the Clearly AWS engagement, the platform was designed with PCI DSS, SOC 2, and ISO 27001 requirements in view, including secrets management. That wording is design intent. It is not a statement that Clearly, or SEYA, holds those certifications.

Questions buyers ask

Can SEYA issue our SOC 2 report?

No. A SOC 2 report is an examination by a licensed CPA firm. SEYA prepares the gap list, the control map, and the evidence index. Your auditor examines them and writes the opinion.

Will readiness stop our releases?

The point of tying evidence to the pipeline is that a release is already a record. We add the checks and the exports your criteria need. We do not replace your delivery process with a monthly evidence project.

Do you guarantee we will pass?

No. The opinion belongs to the auditor, and it depends on how the controls operate over the period they examine. We will tell you which gaps we still see before you book that period. A gap we did not close is written down, not hidden.

Book a cloud security assessment if a customer has asked for a SOC 2 report and you need the gap list before you answer them.