Tier 2 · fixed-price engagement
Attestation readiness scoping
What SOC 2 or ISO/IEC 42001 will take in weeks, in money and in whose time, measured before you commit to either one.
Who this is for
An organization that has been asked for an attestation and needs the real cost of obtaining one before choosing which path to take.
Fixed price
$3,900
- Duration
- 1 week
- Deposit
- $900
- Other currencies
- €3,550 · £2,990 · S$5,200
- Catalog
- T2-09
Thirty minutes with the engineer who would run the work, before any paperwork.
The work, stage by stage
In order, with what happens at each stage and what it produces. The timings are the ones the catalog prices, not an estimate written for this page.
Establish why you are being asked
Day 1
Which customer, which contract clause, and which document they actually want. The answer frequently narrows the scope, and occasionally shows that a different document would satisfy them.
Draw the candidate scope
Day 2
Which systems, which teams and which locations would sit inside it. Scope is the largest single driver of both cost and duration, and it is the one input you control.
Sample the current state
Days 3 to 4
A sample across the control areas rather than a full gap assessment: enough to size the work without doing it. Where the sample finds a systemic gap, that gets sized as a program rather than as a task.
Price it end to end
Day 4
Internal effort by role, the external body's own fee, tooling, and the observation window, which is time that cannot be compressed by spending more.
Compare the two paths
Day 5
SOC 2 and ISO/IEC 42001 side by side against your actual situation, including the case for sequencing them and the case for pursuing only one.
Everything that arrives, listed
The contents of the document, and the artifacts that come with it. If something here would not be useful to you, say so before we start and the scope changes.
- A scope statement you can take to a licensed CPA firm or an accredited certification body for a quote
- A cost model separating internal effort by role, the external body's fee, tooling, and the observation window
- A duration estimate with the parts that cannot be compressed marked as such
- The sampled current state across the control areas, with any systemic gap called out as a program
- A side-by-side comparison of the two paths against your situation, with a recommendation and its reasoning
What this covers, and who takes the rest
Stated up front, because scope is what derails an engagement in week two rather than at the proposal.
Inside this engagement
- The requirement behind the request, traced to the customer or the clause that raised it
- Candidate scope, and its effect on both cost and duration
- A sample of the current state, sized rather than fully assessed
Handled separately
Named so you can plan and budget for it, whether we do it or somebody else does.
- The full control-by-control gap assessment, which is its own engagement once the path is chosen
- The examination or audit itself, performed by a licensed CPA firm or an accredited certification body
Start with a call, not a proposal.
Thirty minutes, straight to the engineer who would run the work. We will tell you if a smaller engagement answers your question, or if nothing here does.
Typical reply within one business day · Engagements start at $2,500
Fixed price · 1 week