Built by a team that’s been through it
We didn’t learn SOC 2 from a slide deck. CAL IT Group completed a SOC 2 Type II audit across all five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality and Privacy — so we’ve built the controls, written the policies and answered the auditor’s requests ourselves. Read about our own SOC 2 Type II.
Our path to audit-ready
- 01 · Scope
Decide what’s in scope
The systems, data and people the report covers, and the Trust Services Criteria that match what you promise customers.
Scope document - 02 · Assess
Gap assessment
Your environment and practices measured against the criteria, with every gap ranked by risk and effort.
Gap report - 03 · Implement
Put the controls in place
MFA and conditional access, endpoint detection and response, logging and monitoring, backups, vulnerability management, access reviews and change management.
Microsoft 365 · Intune - 04 · Document
Policies and procedures
An information security policy set written for how your company actually works, approved by leadership and acknowledged by staff.
Policy set - 05 · Evidence
Collect the proof
Evidence gathered continuously — automated where a compliance platform can do it, organized for the auditor where it can’t.
Compliance platform - 06 · Audit
Support through the audit
A readiness review before the auditor arrives, help choosing an audit firm, and answers to their requests during fieldwork and the observation period.
Auditor requests
Much of SOC 2 is already part of Managed Care
Many of the technical controls auditors test are things Managed Care already runs for you every day:
- Multifactor authentication and managed devices (MDM)
- SentinelOne MxDR and EDR on every endpoint, watched by our 24×7 SOC
- Managed SIEM and logging
- Vulnerability management and patching
- Backups with tested restores
- Security awareness training and simulated phishing
- Every ticket and change documented, with onboarding and offboarding checklists
That leaves the parts only you can own — your policies, your risk decisions and your vendor reviews — and your vCISO guides you through those.
Other frameworks
The same approach works for the other frameworks Orange County companies answer to: CMMC and NIST 800-171 for defense suppliers, and PCI DSS and customer security questionnaires through our security and compliance services.