Book a free consultation
Tell us a bit about your company and where you are with SOC 2. We’ll reply within one business day.
- Phone
- +1-415-571-1034
Email us
The fastest way to reach us. Send a note and we’ll set up a time to talk.
contact (at) marana.ioHelpful to include
- Your company and what you sell
- Where you are with SOC 2 today
- Any deadline, like a deal or audit date
Frequently asked questions
Which compliance standards can you help with?
SOC 2 is our specialty. If you have questions about any other standard or security requirement, reach out anyway. We’ll guide you ourselves or point you to the right person.
How long does a SOC 2 engagement take?
As fast as your team can make progress. Our first client got their first report 3 months after signing. Typically it takes 6 to 9 months to reach Type I, and another 3 to 6 months for Type II.
Which standard do your security policies follow?
Our policies follow ISO 27001, covering the confidentiality, integrity, and availability principles that SOC 2 auditors look for.
We run on AWS, which is already SOC 2 compliant. Why do we need our own report?
SOC 2 evaluates your controls, not your hosting provider’s. AWS’s report belongs in your vendor assessment, but it does not make your company compliant.
Who is behind SOC 2?
The American Institute of CPAs (AICPA). A Type I report assesses the design of your controls at a point in time. A Type II report covers a period of months and tests whether those controls actually operated effectively.
Is a SOC 2 report a legal requirement?
No. But most enterprises that handle sensitive data are obligated to vet their vendors, and a SOC 2 report is how they do it. Having one sets you apart from competitors and shortens security reviews.
What happens if we don’t have a SOC 2 report?
Nothing legal, but deals slow down or stall. Enterprise buyers and investors don’t want security concerns standing in the way, and a report answers most of their questions up front.
Is it ever too late to get SOC 2?
Never. Established companies can still open doors to larger customers. For startups, the best time is during fundraising. Aim to have a report in hand by your Series B.
How hard is the audit itself?
That depends on how well prepared you are. Preparation takes time and attention, which is where we come in. Take it one step at a time, with someone who has done it many times before.