CYBER SECURITY COMPLIANCE · SOC 2
SOC 2 Consulting and Readiness Services
Trust Services Criteria, Type 2 Evidence and the Federal Path It Opens
A SOC 2 Type II report is no longer only an enterprise sales artifact. Under the FedRAMP Consolidated Rules for 2026 it is an approved alternative security framework for FedRAMP 20x Class A, which means a report completed within the previous twelve months can become the foundation of a federal certification path with no agency sponsor. Elevate Consult prepares organizations for the SOC 2 audit and, where federal market entry is the goal, scopes the report so it can carry that second job.
2026 UPDATE
What a SOC 2 Type II now unlocks
SOC 2 Type II is an approved alternative security framework
Under CR26, FedRAMP recognizes SOC 2 Type II, FedRAMP Rev5 including Legacy FedRAMP Ready, and GovRAMP as approved alternative security frameworks for 20x Class A certification. SOC 2 Type II was selected as the initial test case because it is the most widely used external framework. The Class A pipeline opened on 3 August 2026.
The report alone is not enough
Class A additionally requires meeting a mandatory subset of FedRAMP rules covering incident reporting, vulnerability detection and a set of 20x Key Security Indicators across change management, identity and access management and incident response. Reviewers also require a standalone summary per rule: pointing at the SOC 2 report does not satisfy the package requirement.
Scope the report with that in mind
A SOC 2 scoped narrowly for one enterprise customer may not carry the control coverage a Class A package needs. Deciding early whether federal entry is on the roadmap changes which Trust Services Criteria are in scope and what evidence the audit period should produce.
The report must be recent
The qualifying assessment must have been completed within the previous 12 months.
A report older than that does not satisfy the rule, which makes the audit cadence a federal strategy decision rather than only a customer-facing one.
Class A carries no agency sponsor, and real limits
Class A is available only through Program Certification, so no agency sponsor is required. In exchange it is transitory by design: services remain in the Preparation phase on the Marketplace, authorized for negligible or low-risk pilot deployments, with a two-year window to move toward Class B, C or D. There is no reciprocity upward.
WHAT SOC 2 IS
An attestation against criteria you select
SOC 2 was developed by the American Institute of CPAs and sets out the Trust Services Criteria that guide how service organizations manage customer data. The audit is performed by a licensed CPA firm under the AICPA attestation standards, and the output is an opinion rather than a certificate.
Elevate prepares organizations for that audit. Elevate does not perform it, which keeps the readiness guidance free of the independence conflict that would otherwise arise.
THE FICE TRUST SERVICES CRITERIA
Security is mandatory, the rest are scoped
Security, referred to as the Common Criteria, is required in every SOC 2 engagement. Most organizations scope some combination of Security, Availability and Confidentiality. Processing Integrity and Privacy are typically reserved for specialized outsourced services where the commitment specifically requires them.
Security
Common Criteria, mandatory
Information and systems protected against unauthorized access, threats and vulnerabilities. Required in every SOC 2 engagement and the basis of the Common Criteria.
Confidentiality
Scoped when committed
Information designated confidential handled with appropriate protection including encryption and access control.
Privacy
Specialized
Personal information collected, used, retained, disclosed and disposed of in line with the organization’s privacy notice and applicable obligations.
Availability
Scoped when committed
Information and systems accessible for operation and use, meeting uptime and performance commitments made to customers.
Processing Integrity
Specialized
System processing is complete, valid, accurate, timely and authorized. Usually scoped where the service performs transaction processing on a customer’s behalf.
Type 1 and Type 2
Design versus operation
Type 1 assesses design and implementation at a point in time. Type 2 assesses design and operating effectiveness across a period, usually six to twelve months. Only Type II satisfies the FedRAMP Class A alternative framework rule.
OUR PROCESS
Scoping through ongoing compliance
The approach ensures each critical element is addressed, producing a control environment that survives the audit and continues operating afterward.
Scoping and planning
Risk-based scoping identifying the business processes, systems and data flows that affect the applicable criteria, a tailored audit plan, and the request list covering policies, control evidence and procedural documentation.
Gap analysis and documentation
A SOC 2 gap analysis identifying design or execution gaps with recommendations, documentation support for policies and procedures, and a final readiness report covering areas of compliance and remaining steps.
FedRAMP Class A alignment
Where federal entry is on the roadmap, scope the report and the audit period so the resulting Type II supports a Class A package rather than needing a second assessment.
Control evaluation and testing
Assessment of control design against the criteria, and for Type 2 readiness, sampling and testing across the period through interviews, evidence review and system walkthroughs.
Subservice organization treatment
Carve-out or inclusive method decisions for the providers your service depends on, and the complementary user entity controls your own report will place on your customers.
Ongoing support
Control monitoring, policy updates as risk evolves, staff training, and the bridge letter cycle that covers the gap between report periods.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to scope a SOC 2 that does two jobs?
Elevate prepares your organization for the SOC 2 examination and, where federal market entry is on the roadmap, scopes the report and the audit period so the resulting Type II can carry a FedRAMP 20x Class A package.
FAQ
Common Questions
🡪 Can our SOC 2 Type II help us get FedRAMP certified?
It can open the door. Under the FedRAMP Consolidated Rules for 2026, SOC 2 Type II is an approved alternative security framework for 20x Class A certification, provided the assessment was completed within the previous 12 months. It is not equivalent to FedRAMP and does not make an organization FedRAMP certified. Class A additionally requires meeting a mandatory subset of FedRAMP rules and submitting a package where each rule carries its own summary.
🡪 What does Class A actually give us?
Entry. Class A is available only through Program Certification, so no agency sponsor is required, which removes the obstacle that historically delayed federal authorization the longest. In exchange it is transitory: the service remains in the Preparation phase on the Marketplace, authorized for negligible or low-risk pilot deployments, with a two-year window to pursue Class B, C or D. There is no reciprocity from Class A upward.
🡪 Which Trust Services Criteria should we scope?
Security is mandatory in every engagement. Beyond that, scope follows the commitments you actually make to customers: Availability where uptime is committed, Confidentiality where you hold customer data under confidentiality terms. Processing Integrity and Privacy are usually reserved for services where the commitment specifically requires them. Over-scoping adds audit cost without adding a buyer signal.
🡪 What is the difference between Type 1 and Type 2?
Type 1 assesses the design and implementation of controls at a point in time. Type 2 assesses design and operating effectiveness across a period, usually six to twelve months. Type 1 is faster to reach; Type 2 is what most enterprise buyers ask for, and only Type II satisfies the FedRAMP Class A alternative framework requirement.
🡪 Do you perform the audit?
No. The SOC 2 examination is performed by a licensed CPA firm, and Elevate prepares the organization for it. That separation keeps the readiness guidance free of the independence conflict that would arise if the same firm both built and attested to the control environment.
🡪 What happens between report periods?
A gap opens, and customers notice it. A bridge letter from the CPA firm covers the interval between the end of a report period and the issue date of the next report, and it is part of the Class A evidence package where applicable. Planning the report cadence so the gap stays short is a commercial decision as much as an audit one.