Know how ready you are before the audit starts.
Practical, evidence-backed guidance on SOC 2, ISO 27001, security controls, compliance platforms and the real work required to become audit-ready.
SOC 2 · typical preparation stages
- Scope
- Gap assessment
- Remediation
- Evidence
- CPA audit
ISO 27001 · implementation areas
- ISMS scope
- Risk assessment
- Annex A controls
- Internal audit
- Certification audit
What auditors ask to see
- Policies
- Access reviews
- Evidence
- Vendors
- Incidents
- Backups
- Change records
Assessment bands
Readiness assessment
Thirteen questions. An honest picture of where you stand.
Answer for policies, access control, MFA, joiners and leavers, assets, change management, incident response, backups, vendors, awareness, continuity, risk and evidence. You get a readiness band and a prioritised list of what to fix first.
Calculated in your browser; nothing is sent or stored. It is a self-assessment, not an audit opinion, and it never predicts a SOC 2 report or ISO 27001 certification.
High-impact areas first
Access control, multi-factor authentication, incident response and backups are flagged when missing, whatever framework you are aiming for.
Evidence, not intentions
Each question separates "in place, with evidence" from "partly, or informal", because auditors test what you can show.
Security Compliance Cost & Readiness Index
What SOC 2 and ISO 27001 cost, according to the people who publish it.
Audit and certification fee ranges, all-in first-year estimates, platform pricing status and typical timelines. Every figure is attributed to its publisher, labelled by source type, dated, and downloadable as CSV. We never estimate a price ourselves.
SOC 2
Audit fees and first-year totals from CPA firms and compliance vendors, split by Type 1 and Type 2 where the publisher does.
ISO 27001
Certification audit, surveillance and three-year cycle figures, with the currency and scope each publisher states.
Start here
Guides built on authoritative sources
What SOC 2 readiness involves
The Trust Services Criteria, who issues the report, and the work before a CPA firm examines you.
Read the guide SOC 2Type 1 vs Type 2
Point in time or period of time: what each covers, how long it takes and what the published fees look like.
Compare ISO 27001ISO 27001 readiness and certification
The 2022 standard, its 93 Annex A controls in four themes, and how the three-year certification cycle works.
Read the guide ComparisonSOC 2 vs ISO 27001
Attestation report or certificate, CPA firm or certification body: the differences that shape your choice.
Compare PlatformsCompliance automation platforms
What these platforms do, which frameworks each lists, and whether any publishes a price. No pay-to-rank.
See the platforms ToolReadiness assessment
Thirteen areas, a readiness band and a prioritised to-do list. Free, private, deterministic.
StartSide by side
Two routes to proving your security
An attestation report
- Issued by
- An independent CPA firm, against AICPA's Trust Services Criteria
- Always in scope
- Security (the common criteria)
- Output
- A report, not a certificate
- Type 2 period
- Typically 3–12 months, per auditors
A certification
- Issued by
- An accredited certification body
- Standard
- ISO/IEC 27001:2022, an ISMS standard
- Annex A
- 93 controls in four themes
- Cycle
- Three years, with annual surveillance audits
Why trust Baseline Ready
Evidence before recommendations.
Primary sources
Framework facts traced to AICPA, ISO, NIST and CISA, with every source labelled by type so you can see who is speaking.
No pay-to-rank
Commercial relationships never decide which platform we describe or in what order. Any relationship is disclosed.
Last verified
Vendor and cost facts are re-checked at least every 45 days, framework facts every 180; stale pages are refused by our publishing system.