packets.build00 SOC 2
SOC 2 Type I and II, run for you
Trust Services Criteria scoped, controls in place and evidence collected through your observation window, with a Forward Employee, a SOC 2 expert and AI agents on one platform.
For AI-native, IT services, fintech and healthtech teams selling to US and Canadian enterprise.
SOC 2 readiness
- CC6.1 Logical accessPassing
- CC7.2 System monitoring1 finding
- CC9.2 Vendor riskPassing
SOC 2 at a glance
What to expect before you start.
- 5–6 months
Typical time to a Type II report, including a three-month observation window.
Typical packets plan - 5
Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
The AICPA criteria - 3–12 months
The period a Type II report covers. Type I covers a single date.
Standard practice - Every year
Buyers expect a fresh report each year, so the programme keeps running.
Standard practice
01 Typical audit schedule
Your path to a SOC 2 report
Five stages to your report, and who does what at each.
Scope
Month 1Pick the criteria and systems in scope.
Platform
- SOC 2 template mapped to the Trust Services Criteria
Agents
- Read your onboarding answers and connected tools for a first gap list
Your packets team
- Agree the criteria and systems with you
- Plan Type I, Type II or both
You
- One kickoff call
- Name an owner and approve the scope
Output Scope and gap list
02 Who works on it
Three kinds of help, one programme
A SOC 2 window runs for months. Someone has to keep it running. The strip under each card shows when they are working on your report.
- Within 5 working days
Forward Employee
Embedded in your team
Joins your team and drives the SOC 2 work end to end, through the whole observation window: evidence, documents, reviews and auditor follow-up.
- Runs the weekly cadence with your owner
- Keeps the window on track
- Handles auditor requests
- Every milestone
SOC 2 expert
At every milestone
Leads scoping, the readiness review and auditor coordination. No separate consulting fee.
- Criteria and scope
- Readiness review
- Auditor coordination
- From day one
AI agents
Working from day one
Work from your company's context. They draft policies, run integration checks daily and save the results as evidence, and surface gaps. A person approves what counts.
- Draft policies
- Run daily checks
- Collect evidence from your tools
03 Trust portal
Show progress before the report
Publish a Trust Center with your SOC 2 status, live controls and published policies, synced from your packets workspace. Buyers see where you stand while the window runs.
- Logical accessImplemented
- Change managementImplemented
- System monitoringIn progress
Synced from your packets workspace · just now
04 How SOC 2 gets done
Platform, agents and people, for SOC 2
The platform holds the criteria and evidence. Agents keep checks running through the window. People make the scoping and audit calls.
Platform
What it holds
- Trust Services CriteriaSecurity, plus the criteria you choose, mapped to controls.
- Controls and tasksAn owner and evidence for each one.
- Evidence over timeVersions and expiry dates across the observation window.
- Audit workspaceReadiness, findings and remediation in one place.
Autonomous agents
What they do
- Integration checksGitHub, Microsoft 365 and ten more tools, checked daily.
- Policy draftsTailored to your company and waiting for your approval.
- EvidenceSaved on the control task, dated and versioned.
Humans →
What they implement
- ScopingCriteria, systems and Type I or Type II, agreed with you.
- Readiness reviewBefore the observation window starts.
- Auditor coordinationWith the CPA firm you choose.
- Management assertionPrepared with your leadership.
On file
- PagerDuty · escalation policyApproved
- Tailscale · key expiry onApproved
Agents collect it
Your team approves it
Agents save evidence and drafts into the platform. A person on your team approves them there.
05 Compare
Four ways to get SOC 2. One comes with someone accountable.
| Question | A compliance tool | A consultant | A hire | packets |
|---|---|---|---|---|
| Who is accountable | Your engineer | Nobody, after the engagement | Whoever you hired, once ramped | Your packets team, from week one |
| Who does the work | You | Advises; you implement | One person, part-time | Agents at volume, plus specialists |
| Policies and evidence | Templates to fill in | Document set, handed over | Written from scratch | Drafted and mapped; you approve |
| Observation window | Your team keeps it running | Not around for it | One person, for months | Checks and evidence run through it |
| Checking controls | Yes, automated | No system | Manual, or a tool too | Daily checks, same system |
| Adding a framework | Start the checklist again | A new engagement | More work, same person | Reuses controls in place |
| Next year's report | Renews; work still yours | Starts from scratch | Depends on them staying | Same system, nothing restarts |
| What it costs | Licence, plus the work | Project fee, no system | ₹30–35L a year, plus time to hire | One fixed price |
Hire cost from the packets comparison on packets.build. Your quote depends on scope and frameworks. Auditor fees are separate.
06 Features
What runs your SOC 2 programme
Specific to SOC 2
Criteria mapping
Controls mapped to the Trust Services Criteria you choose.
Evidence across the window
Dated, versioned evidence with expiry, so gaps show before the auditor sees them.
Audit workspace
Your auditor scores requirements and records findings in one place.
In every packets programme
Controls
Each control maps to the requirements it satisfies, so work counts once.
Policies
A full policy set drafted for how you operate, with approvals recorded.
Integrations
GitHub, Microsoft 365, GitLab, Cloudflare and more, checked daily.
Risk register
Risks drafted from your context, approved by you, linked to controls.
Vendor management
Your suppliers, their risks and the records behind them.
Trust portal
Your status, controls and policies on one public page.
Employee portal
Staff read and accept policies and complete their own tasks.
AI agents
Draft, check and collect, so your team only reviews.
07 Framework overlap
Already doing SOC 2? Much of the next one is done.
One control can satisfy requirements in several frameworks, so SOC 2 gives you a head start on the next one. Each card shows how much of the main work is already done, and what is left.
StartingISO 27001after SOC 2
4 of 7already done
- Access control, change management and monitoring controls
- Risk assessment and vendor management
- Policies and incident response
- Evidence already on your control tasks
- A management system: scope, objectives, management review
- An internal audit
- A Statement of Applicability and a certification body
StartingGDPRafter SOC 2
3 of 6already done
- Security of processing controls
- Incident response
- Vendor due diligence
- Records of processing activities
- A lawful basis for each activity
- Data subject request handling
StartingHIPAAafter SOC 2
2 of 4already done
- Access, logging and encryption controls
- Risk assessment
- Business associate agreements
- HIPAA breach notification rules
StartingISO 42001after SOC 2
2 of 4already done
- Security controls around your AI systems
- Vendor management for model providers
- An AI management system and AI policy
- An AI system register and impact assessments
Counts are of the main pieces of work, not a measured percentage of controls. Your scope decides the rest.
08 Which one first
Your buyers decide which framework you need
Selling in both markets? We run ISO 27001 and SOC 2 on one set of controls.
- US and Canadian enterprise buyersSOC 2 Type II This page
- Enterprise buyers in India, Europe and the Middle EastISO 27001 →
- Anyone whose users are in EuropeGDPR readiness →
- Buyers reviewing an AI productISO 42001 →
09 After the report
One report is a milestone. The next window has already started.
SOC 2 is renewed every year. The same system and team keep the evidence flowing, so next year's report is not a new project.
- Every day
Integration checks run and expired evidence is flagged for refresh.
- Every quarter
Access, risk and policy reviews, ready for you to sign off.
- Every year
A new observation window and report, from evidence already in place.
- When you grow
Add criteria or a new framework on the same controls.
Already using another tool or consultant?
Bring your controls, policies, risk register and vendor list. We plan the move around your window and audit dates.
10 Questions
Questions about SOC 2
01What is the difference between Type I and Type II?
Type I reports on whether your controls are designed well at a single date. Type II reports on whether they worked over a period, usually three to twelve months. Most enterprise buyers ask for Type II.
02How long does SOC 2 take with packets?
Typically five to six months to a Type II report with a three-month window. A Type I report can come earlier, around month three.
03Who issues the report?
A licensed CPA firm. You can keep your own auditor. packets prepares you and coordinates with them until the report is issued.
04Is SOC 2 a legal requirement?
No. Buyers ask for it, especially in the US and Canada, as proof that you protect their data.
05Which Trust Services Criteria do we need?
Security is always in scope. Availability, processing integrity, confidentiality and privacy are added when your buyers or your service call for them. We decide this with you at scoping.
06What do we do during the observation window?
Keep running your controls. Checks run daily, evidence is saved and your packets team keeps reviews on schedule. You approve the occasional fix.
07Should we do SOC 2 or ISO 27001 first?
Start with what your buyers ask for. Much of the control work carries over, and we can run both on one set of controls.
08What is not included?
Auditor fees, penetration testing, engineering work on your systems and legal advice are separate. We help you plan for each.
11 Keep exploring
Before you book a call
Get your SOC 2 report. Keep it every year.
Talk to us about your criteria, your buyers and your timeline.
- A Forward Employee in your team within five working days
- A SOC 2 expert at every milestone
- Daily checks through the whole window