What is a compliance gap assessment?

A compliance gap assessment evaluates the difference between your organization's current security controls and the requirements of a specific framework such as SOC 2, ISO 27001, or HIPAA. It identifies which controls are fully in place, which are partially implemented, and which are missing — then produces a prioritized roadmap to close those gaps before an audit. Conducting a gap assessment before engaging an auditor typically reduces audit preparation time and cost significantly, since you know exactly where to focus remediation effort.

What is the difference between SOC 2 Type I and SOC 2 Type II?

SOC 2 Type I is a point-in-time assessment that verifies your security controls are suitably designed as of a specific date — it can sometimes be achieved in as little as 45 days. SOC 2 Type II evaluates whether those controls actually operated effectively over an observation period, typically 3–12 months, making it a far more credible report. Enterprise customers almost universally require a Type II report. If you need a compliance credential quickly to close a deal, a Type I is a valid intermediate step — but plan to begin your Type II observation period immediately after.

How long does it take to get SOC 2 certified from scratch?

From a standing start, SOC 2 Type I can be achieved in 3–6 months with focused preparation. SOC 2 Type II requires an additional 3–12 month observation period on top of that, putting total time at 6–18 months for most organizations. The biggest variables are your current security maturity, whether you use a compliance automation platform, and how quickly you can remediate gaps identified in your readiness assessment. Running a gap assessment first — before hiring an auditor — is the fastest way to compress the timeline, because you avoid discovering critical gaps mid-audit.

If I already have SOC 2, how long does it take to get ISO 27001?

If your organization is already SOC 2 certified, achieving ISO 27001 typically takes 3–6 months rather than the standard 6–12 months, because a large portion of the required controls already exist. The two frameworks share substantial overlap in areas like access control, encryption, vulnerability management, and incident response. The main additional work for ISO 27001 involves establishing a formal Information Security Management System (ISMS), completing a documented risk assessment, and preparing for the two-stage audit process. Stage 1 of the ISO audit typically takes 2–3 days; Stage 2 can be completed within 1–2 weeks. Many organizations pursue both simultaneously to maximize efficiency — running the ISO 27001 audit in parallel with SOC 2 evidence collection can cut the combined timeline significantly.

If I already have ISO 27001, how long does it take to get SOC 2?

For ISO 27001-certified organizations, SOC 2 readiness is typically achievable in 2–4 months for Type I, with your Type II observation period starting immediately. ISO 27001's structured ISMS, documented risk assessments, and Annex A controls map well onto SOC 2's Trust Services Criteria. The key gaps to address are usually around the specific SOC 2 Trust Services Criteria your ISO program did not explicitly cover — particularly Availability and Processing Integrity if those weren't in scope. The audit itself for SOC 2 can often be completed concurrently with your ISO surveillance cycle, saving both time and auditor fees.

If I'm already HIPAA compliant, how long does it take to get SOC 2?

Organizations already meeting HIPAA requirements have a strong foundation for SOC 2, since both frameworks share controls around access management, encryption, audit logging, incident response, and vendor risk management. From a HIPAA baseline, SOC 2 readiness typically requires a 2–3 month gap analysis followed by remediation, then a 3–12 month observation period for Type II. By leveraging existing HIPAA controls, organizations can reduce overall compliance effort by 30–40% and compress timelines from a typical 9 months down to roughly 4–5 months. The main additional work involves addressing the SOC 2-specific Trust Services Criteria that HIPAA does not directly cover, such as Availability and Processing Integrity.

If I'm already PCI DSS compliant, how long does it take to get SOC 2?

PCI DSS and SOC 2 share approximately 60% of their control requirements, particularly around access control, encryption, network security, vulnerability management, and vendor oversight. For PCI DSS-certified organizations, SOC 2 readiness typically takes 3–6 months rather than the standard 6–12, and combining both audits can cut the total timeline by 1–3 months and reduce costs by up to 30%. The primary gaps to address are the areas of SOC 2's Trust Services Criteria not covered by PCI's more narrowly scoped cardholder data environment — particularly broader organizational controls, availability commitments, and privacy practices.

What is the fastest way to achieve SOC 2 compliance?

The fastest path to SOC 2 is: (1) run a gap assessment immediately to identify exactly which controls are missing before engaging an auditor; (2) target SOC 2 Type I first, which can be achieved in as little as 45 days with high security maturity; (3) use a compliance automation platform to accelerate evidence collection and policy documentation; (4) start your Type II observation period immediately after Type I, running both in parallel rather than sequentially. Organizations that skip the gap assessment phase and engage auditors prematurely often discover critical gaps mid-audit, extending timelines by months. A thorough readiness assessment is the single highest-leverage action for compressing your timeline.

Should I get SOC 2 or ISO 27001 first?

The right choice depends on where your customers are and what they're asking for. SOC 2 is the dominant standard for North American SaaS and cloud companies — if your prospects are US-based enterprise buyers, SOC 2 is almost always requested first. ISO 27001 carries stronger recognition internationally, particularly in Europe, Asia-Pacific, and the Middle East, and is increasingly required by multinational enterprises. If you're expanding globally, ISO 27001 is typically the better long-term investment. Many organizations with a mixed customer base pursue both simultaneously, since the control overlap means dual certification requires roughly 30–40% more effort than either alone, not double the work. A gap assessment that maps your current controls against both frameworks helps you understand exactly how much additional work each path requires from your current position.

How much does SOC 2 certification cost?

SOC 2 certification typically costs $30,000–$100,000 total in the first year, broken down as: audit fees ($20,000–$50,000), readiness preparation and gap remediation ($5,000–$20,000), and compliance tooling ($5,000–$30,000 annually). Subsequent years are less expensive since the observation period and initial buildout are behind you. The most significant cost driver is your current security maturity — organizations with strong existing controls spend considerably less on remediation. Running a gap assessment before engaging an auditor is the best way to estimate your specific cost, since it reveals exactly how much remediation work stands between you and audit readiness.

How much does ISO 27001 certification cost?

ISO 27001 certification costs typically range from $15,000 to $60,000 for small to mid-sized organizations, and can run higher for larger or more complex environments. ISO 27001 is generally 1.5–2x more expensive than SOC 2 on average due to the more comprehensive ISMS requirements and two-stage audit process. Ongoing costs include annual surveillance audits for two consecutive years, followed by a full recertification audit in year three. Organizations already holding SOC 2 can often achieve ISO 27001 at the lower end of the cost range due to existing control documentation and evidence.

Can SOC 2 and ISO 27001 be achieved at the same time?

Yes, and doing so is increasingly common because the two frameworks share substantial control overlap — estimates range from 70% to over 90% depending on scope. By pursuing both simultaneously, organizations can consolidate evidence collection, run coordinated audits, and avoid duplicating policy documentation and control walkthroughs. Combined audits have been shown to cut overall compliance timelines by 1–3 months and reduce costs by 20–30% compared to sequential certifications. The main challenge is coordinating two different audit processes and auditor relationships at the same time, which is easier with a compliance automation platform or a firm that handles both.

Does SOC 2 compliance mean I'm also HIPAA compliant?

No — SOC 2 and HIPAA are not interchangeable. SOC 2 demonstrates strong general security practices, but HIPAA requires specific controls for protecting Protected Health Information (PHI) that go beyond what SOC 2 covers. Areas that HIPAA requires but SOC 2 does not explicitly address include: formal HIPAA-compliant policies and procedures, Business Associate Agreements (BAAs), workforce authorization and supervision for ePHI access, workstation-level controls, and specific breach notification timelines. That said, a strong SOC 2 posture covers a significant portion of HIPAA's Security Rule requirements, and organizations pursuing both can reuse a large portion of their evidence and controls.

What compliance frameworks does Gap Assessment support?

Gap Assessment supports 35+ frameworks including SOC 2, ISO 27001, ISO 27701, HIPAA, GDPR, PCI DSS, NIST CSF, NIST 800-53, NIST 800-171, CMMC, FedRAMP, SOX ITGC, CCPA, LGPD, PIPEDA, APRA CPS 234, CIS Controls, HITRUST CSF, StateRAMP, TX-RAMP, CJIS, IRAP, ENS, TISAX, SWIFT CSP, DORA, NIS2, Cyber Essentials, and CSA STAR. The tool also shows the control overlap between any frameworks you select, so you can plan the most efficient path to multi-framework compliance.

What is the difference between SOC 2 and GDPR?

SOC 2 and GDPR serve different purposes and are not substitutes for each other. SOC 2 is a voluntary US framework that demonstrates your security and privacy controls to customers and partners. GDPR is mandatory EU law that governs how any organization — regardless of location — handles the personal data of EU residents. SOC 2 compliance does not make you GDPR compliant, but a SOC 2 program with the Privacy Trust Services Criterion included covers significant ground toward GDPR's technical and organizational security requirements. Organizations selling into Europe typically need to address both.

Is Gap Assessment free to use?

Yes. The complete gap assessment, AI-generated analysis, readiness scores, priority action plan, and downloadable PDF report are all free. You provide your email to unlock the full detailed gap assessment table and implementation roadmap sections.

What is included in SOC 2 compliance?

SOC 2 compliance is built around five Trust Services Criteria (TSC): Security (mandatory for every SOC 2 report), Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only required category — the others are included based on what your organization does and what your customers need. In practice, achieving SOC 2 requires: documented security policies and procedures; technical controls such as multi-factor authentication, encryption at rest and in transit, firewalls, and intrusion detection; access management including role-based access controls and regular user access reviews; a formal risk assessment process; vulnerability scanning and patch management; an incident response plan; vendor/third-party risk management; employee security awareness training; and change management controls. You also need to collect and organize audit evidence across all of these areas for the entire observation period — which is why SOC 2 Type II typically requires 6–12 months of preparation and monitoring.

What is included in ISO 27001 certification?

ISO 27001 certification requires two interconnected components. First, Clauses 4–10 define mandatory management system requirements: establishing the scope and context of your ISMS; demonstrating leadership commitment; conducting formal risk assessments and risk treatment planning; implementing security controls; and running continuous improvement cycles including internal audits and management reviews. Second, Annex A provides 93 security controls (as of the 2022 update) grouped into four categories — organizational (37 controls), people (8 controls), physical (14 controls), and technological (34 controls). You do not have to implement all 93; instead, you perform a risk assessment to determine which controls apply, then document your decisions in a Statement of Applicability (SoA). Key areas covered include information security policies, access control, asset management, cryptography, physical security, supplier relationships, incident management, business continuity, and secure development. The certification process involves a two-stage audit by an accredited certification body.

When should a startup get SOC 2?

The right time to pursue SOC 2 for a startup is typically when you begin selling to enterprise or mid-market B2B customers, or when a prospect explicitly asks for it. Research suggests that roughly 74% of enterprise buyers require SOC 2 before working with a new vendor, and deals frequently stall or collapse when a startup cannot provide a report on demand. The earlier you start, the less expensive it is — retrofitting security controls into an established product and organization costs significantly more than building them in from the start. As a practical trigger: if your first enterprise prospect has asked for a SOC 2 report, that means multiple future prospects will too. Most startups begin with SOC 2 Type I to unblock immediate deals, then start their Type II observation period immediately afterward. The mandatory 3-month minimum observation period for Type II cannot be accelerated regardless of budget, so starting early matters.

Do I need SOC 2 if I'm a small company or startup?

SOC 2 is not legally required for any company — it is a voluntary standard. However, it has become effectively mandatory for B2B SaaS and cloud companies that sell to enterprise and mid-market customers, regardless of the vendor's size. Enterprise procurement and security teams evaluate new vendors on the same criteria whether the vendor has 5 employees or 500. If you're a B2C company selling directly to consumers, SOC 2 is generally not needed. But if your product handles customer data and you're selling to businesses — particularly in regulated industries like finance, healthcare, or government — SOC 2 is likely a requirement to close deals above a certain contract value. A gap assessment is a useful first step to understand how much work stands between your current security posture and audit readiness.

How is a SOC 2 audit different from ISO 27001 certification?

The most important structural difference is flexibility vs. prescription. SOC 2 is flexible — you choose which Trust Services Criteria to include, and you decide how to implement controls that meet those criteria. ISO 27001 is more prescriptive, requiring a formally structured Information Security Management System (ISMS) that meets defined clauses, plus a documented risk treatment process and Statement of Applicability for all 93 Annex A controls. A SOC 2 audit is conducted by a licensed CPA firm and produces an attestation report — not a certification. ISO 27001 certification is issued by an accredited certification body (not a CPA) and results in a formal certificate that must be renewed every three years with annual surveillance audits in between. SOC 2 reports are typically valid for 12 months and must be re-issued annually. ISO 27001 is internationally recognized as a formal certification; SOC 2 is primarily recognized in North America and is treated as a compliance attestation rather than a certification.

What does a compliance gap assessment report include?

A comprehensive compliance gap assessment report typically includes: an overall readiness score showing your current compliance posture as a percentage; per-framework readiness scores for each framework you are assessing against; a domain-by-domain breakdown showing which control areas are fully present, partially implemented, or missing; a gap assessment table listing specific control gaps with their current state and recommended remediation; a prioritized action plan ranking gaps by risk impact and effort; an implementation roadmap organized into phases (typically 30/60/90 days and 6-month horizons); a security tools and budget estimate for the recommended remediation investments; framework overlap analysis showing which controls count toward multiple certifications; and an executive summary suitable for sharing with leadership or a board. Gap Assessment generates all of these sections automatically using AI analysis, and makes the full report available as a downloadable PDF.

What is the difference between a gap assessment and a readiness assessment?

The terms are often used interchangeably, but there is a subtle distinction. A readiness assessment is typically a broader evaluation of whether your organization is prepared to undergo a formal audit — it produces a yes/no or percentage readiness score. A gap assessment goes deeper: it identifies the specific controls that are missing or partially implemented, explains why each gap matters, and produces a concrete remediation roadmap. In practice, the best compliance gap assessments include both — they tell you your readiness level and exactly what needs to be fixed to reach audit-ready status. Running a gap assessment before engaging an auditor is considered best practice because it prevents costly surprises mid-audit and allows you to budget accurately for remediation.

Which industries need SOC 2 compliance?

SOC 2 is most commonly required in industries where service organizations store, process, or transmit sensitive customer data on behalf of other businesses. The most active industries include: SaaS and cloud software companies (especially those selling to enterprise); fintech and financial services; healthcare technology and digital health platforms; managed IT services and MSPs; data analytics and business intelligence platforms; HR and payroll technology; legal technology; and any company operating in the supply chain of a regulated industry. SOC 2 is not legally mandated in any of these industries, but enterprise and mid-market customers in these sectors routinely require it as a vendor qualification. Healthcare companies may need both SOC 2 and HIPAA compliance. Companies handling payment data may need SOC 2 alongside PCI DSS.

How often do you need to renew SOC 2 or ISO 27001?

SOC 2 reports do not expire on a fixed schedule, but they become stale quickly — most enterprise customers expect a report issued within the last 12 months. In practice, the vast majority of SOC 2-certified organizations undergo an annual Type II audit to maintain a current, credible report. There is no formal renewal process; you simply commission a new audit each year. ISO 27001 certification has a formal 3-year certification cycle. After initial certification, your organization must undergo surveillance audits in years one and two to confirm the ISMS is being maintained. In year three, a full recertification audit is required to renew the certificate. Annual surveillance audits are typically less intensive than the initial certification audit, but they require ongoing evidence of continuous improvement and control effectiveness.

What is the difference between NIST CSF and SOC 2?

NIST CSF (Cybersecurity Framework) is a voluntary framework published by the US National Institute of Standards and Technology that helps organizations manage and reduce cybersecurity risk. It is organized around five functions: Identify, Protect, Detect, Respond, and Recover. It does not result in a formal certification or audit report. SOC 2, by contrast, is an audited attestation standard — an independent CPA evaluates your controls against the Trust Services Criteria and issues a report that you can share with customers as proof of compliance. NIST CSF is often used internally as a risk management tool or as a foundation for building a security program; SOC 2 is the external-facing credential customers and prospects actually ask for. Many organizations use NIST CSF to build their security program and then pursue SOC 2 to prove it to the market. Gap Assessment assesses readiness for both frameworks.

What is CMMC and who needs it?

CMMC (Cybersecurity Maturity Model Certification) is a US Department of Defense framework that any company in the Defense Industrial Base (DIB) must comply with if they handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC has three levels: Level 1 covers basic cyber hygiene for FCI; Level 2 aligns with NIST SP 800-171 and applies to most CUI handlers; Level 3 is reserved for organizations working on the most sensitive DoD programs. CMMC compliance will be required in all new DoD contracts, meaning any company that wants to bid on government defense work will need to achieve and maintain the appropriate CMMC level. CMMC shares significant control overlap with NIST 800-171, ISO 27001, and SOC 2, so organizations already certified under these frameworks are often well-positioned for CMMC.

What is the difference between FedRAMP and SOC 2 for government contracts?

FedRAMP (Federal Risk and Authorization Management Program) is the US government's compliance framework for cloud service providers that want to sell to federal agencies. It is based on NIST 800-53 controls and requires a formal Authorization to Operate (ATO) issued by a federal agency or the Joint Authorization Board. FedRAMP authorization is mandatory for cloud services used by US federal agencies — it is not optional. SOC 2 is a private-sector framework primarily used to satisfy enterprise customer security requirements; it does not qualify a vendor for federal government contracts. FedRAMP is significantly more rigorous and expensive than SOC 2, typically costing $500,000–$2 million+ in the first year. Organizations with SOC 2 and NIST CSF compliance already in place are better positioned to pursue FedRAMP, but considerable additional work is required.

Benchmark your compliance posture against 30+ frameworks.

A control-by-control compliance gap assessment across SOC 2, ISO 27001, HIPAA, CMMC, and more, benchmarked against companies like yours. Know which frameworks apply, where your gaps are, and what closing them will cost before you engage a consultant.

See what you receive

No cost. About 10 minutes. No sales call.

Readiness summarySample report

56%

Overall readiness

Developing

64%SOC 2

52%ISO 27001

41%HIPAA

Control domains, weakest first

Operational program38%

Policies and governance41%

Monitoring and response48%

Data security55%

Device security64%

Security awareness70%

Access control76%

6 missing 11 partial 19 present

Frameworks covered

SOC 2
ISO 27001
HIPAA
GDPR
PCI DSS
FedRAMP
CMMC
EU AI Act
DORA
Essential Eight
and 25 more

Compliance is confusing. You're not alone.

These are the questions security and compliance leaders bring to a consultant. The assessment answers them for your specific profile.

“Do we need SOC 2 or ISO 27001? Both? Neither?”

“A prospect asked for our certifications. What do we say?”

“We're about to go through a security review. Are we ready?”

“Should we start with SOC 2 Type I or jump to Type II?”

“We handle EU customer data. Do we need GDPR compliance?”

“Our DoD contract requires CMMC. Where do we even start?”

A gap assessment gives you clarity in minutes — not weeks and not thousands of dollars.

What the assessment delivers

The same outputs a consulting engagement produces, generated from your answers in about 10 minutes.

Framework match report

Comparable value ~$2,000

Stop guessing which certifications you actually need. We analyze your industry, customer type, and data profile to tell you exactly which frameworks apply — and which ones are a waste of your time and money.

Security readiness score

Comparable value ~$3,000

A gap assessment across 7 security domains, scored and benchmarked. Know precisely where you stand before you spend a dollar on a consultant or auditor.

Phased implementation roadmap

Comparable value ~$2,500

A week-by-week action plan sequenced by priority and tailored to your gaps — not a generic checklist. Exactly what a vCISO would hand you after a $5k engagement.

Tools and budget estimate

Comparable value ~$1,500

Every tool category you'll need, with real cost ranges for your company size — and which ones your cloud provider gives you for free. Know your full compliance budget before you commit to anything.

Framework overlap map

Comparable value ~$1,000

See exactly how much of each framework you get for free by completing your primary one first. Most companies don't realize SOC 2 buys them 60–70% of ISO 27001 — we show you the math.

AI executive report (PDF)

Comparable value ~$2,000

A boardroom-ready PDF with your scores, gaps, roadmap, and tools budget — written by AI, personalized to your company. Ready to share with your board, investors, or auditor.

Typical consulting engagement$5–15K

Time to results10 min

There's no cost to run the assessment. Some companies choose to work with our partner network to implement the roadmap; there's never an obligation.

How it works

Four steps, about ten minutes end to end. Your score appears the moment you finish.

1
2 minutes
Tell us about your company
Your industry, size, customer type, and data profile — so we tailor everything to your actual situation, not a generic template.
2
1 minute
See your framework recommendations
We'll tell you exactly which certifications matter for your business and why — ranked by urgency and business impact.
3
5 minutes
Answer your readiness questions
A focused assessment across 7 security domains. No trick questions — just an honest picture of where you stand today.
4
Instant
Get your full gap assessment
Your control-by-control gap analysis, delivered the moment you finish. Yours to keep.
- Gap assessment
- Readiness score
- Implementation roadmap
- Tools and budget estimate
- AI executive report (PDF)

Want someone to implement this for you?

Complete your assessment and walk away with a full gap report, roadmap, and budget. If you want expert hands to execute it, we've built a trusted network of vCISOs, GRC platforms, and penetration testing firms — vetted, prepared, and available at pre-negotiated rates. No cold outreach. No blank-slate retainer.

vCISOs, GRC platforms, and pen test firms
They receive your full report before the first conversation
Pre-negotiated rates — typically less than booking direct
No discovery tax — they arrive knowing your gaps

Built for the people accountable for compliance

Use it to pressure-test a program, brief leadership, or scope work before you engage an auditor.

CISO or security leader

Get a second opinion on your program and see what needs to be fixed first.

Chief Compliance Officer

Map obligations across frameworks and see where controls overlap.

Enterprise risk leader

Quantify readiness by domain and size the budget before committing to a program.

Founder, CEO, or CTO

Understand your compliance risk before a deal gets blocked.

Common questions

Know where you stand before your next audit.

Readiness score, implementation roadmap, tools budget, and AI executive report — in 10 minutes. No consultant. No sales call. No obligation.

About 10 minutes