Compliance support
SOC 2 Compliance and PCI Support
Larger clients now send security questionnaires and ask for a SOC 2 report. If you take card payments, PCI DSS applies too. We help with the IT side of SOC 2 compliance and PCI: the controls, the evidence, and the upkeep.
Auditors and assessors do the formal review. We help you be ready for it.
- Serving Los Angeles
- Business IT since 1998
- Remote first, on-site when needed
Two frameworks
SOC 2 compliance and PCI DSS in plain English
SOC 2 is an attestation report produced by an independent CPA firm. It describes how a service company protects customer data, using criteria set by the AICPA such as security, availability, and confidentiality. Clients ask for it because it saves them from auditing you themselves.
PCI DSS is the card industry’s security standard. Any business that stores, processes, or transmits card data must follow it. The effort depends heavily on how you take payments, and the best move is often to keep card data off your systems entirely.
IT work we help with
- Access reviews and MFA
- Encryption on devices and data
- Logging and alerting
- Patch and change records
- Backup and recovery testing
- Vendor and device inventories
We are not an audit firm. Reports and assessments come from independent auditors and assessors.
How we support SOC 2 compliance and PCI
Readiness review
Compare your IT to the controls the audit will test.
Control setup
MFA, encryption, logging, and endpoint protection.
Evidence collection
Screenshots, logs, and records organized for the auditor.
Policies
Technical input for access, change, and incident policies.
Payment scope
Reduce PCI scope with hosted payment pages and terminals that keep card data off your network.
Testing
Vulnerability scans and penetration tests when required.
How we start
- Understand the askWhich report, which standard, and which client is asking.
- Find the gapsA readiness review against the controls.
- Close and keepFix gaps and keep evidence current all year.
Making SOC 2 compliance manageable for small teams
A Type 1 SOC 2 report looks at controls at a single point in time. A Type 2 report checks that controls worked over a period, often several months to a year. Many companies start with Type 1, then move to Type 2. Either way, the controls must actually run every day, not just on audit week.
Official sources
The AICPA describes SOC 2 in its overview of SOC services. The current card standard and self-assessment questionnaires are published by the PCI Security Standards Council.
Controls that serve both
- Unique accounts and MFA for everyone
- Prompt removal of access when staff leave
- Encrypted laptops and backups
- Central logs kept and reviewed
- Documented changes to systems
- Annual security awareness training
Keeping PCI scope small
If card numbers never touch your computers or network, your PCI obligations shrink a lot. Hosted payment pages, tokenization, and standalone terminals help. We review how payments flow and recommend ways to keep card data out of your environment.
Between audits
The hard part of SOC 2 compliance is staying compliant. Access reviews, patch records, and backup tests must happen on schedule. As part of managed IT services, we run those tasks and keep the evidence, so next year’s audit is calmer. Financial firms can also see IT for financial firms.
Answering security questionnaires
Even before a formal report, clients send long questionnaires about your security. We help you answer the technical questions accurately and build a standard set of answers you can reuse, which saves time on every new deal.
SOC 2 compliance FAQ
Can you give us a SOC 2 report?
No. Only an independent CPA firm can issue one. We help you get ready and stay ready.
Do small companies need SOC 2?
Only if clients ask. Many small service firms get it to win larger contracts.
Does PCI apply if we use a payment processor?
Usually yes, but in a smaller form. How you accept cards decides which questionnaire applies.
How long does readiness take?
It depends on your starting point. Gaps in MFA, logging, and documentation take the most time.
Related services
Managed security services
Controls that run every day.
Penetration testing
Testing for audits and card data.
Cybersecurity risk assessment
Find gaps first.
IT for financial firms
Compliance-minded IT.
Get ready for the audit
Tell us which report or standard your clients are asking for.
On-site and remote IT since 1998.