FAQ
Frequently asked questions
Getting started
GetComply provides an outsourced security governance, risk, and compliance function. A named advisor maintains your program plan, policies, risk records, reviews, evidence, remediation tracking, reporting, and customer assurance work as defined in the engagement. Management retains the authority to approve policies and risk decisions.
No. Managed GRC works whether you hold a SOC 2 report, are pursuing one, or have no certification plans. SOC 2 readiness is one service we offer, not a requirement.
Primarily cloud-hosted B2B software companies with customer security requirements and limited internal capacity for recurring GRC work. Fit depends on the systems involved and the workload.
Someone from GetComply reviews the information, follows up to arrange a discussion, and asks for the facts needed to determine scope and fit. If the service is appropriate, we prepare a written proposal. Requesting an intro call does not enroll you in an automated marketing sequence.
Services and pricing
Launch Readiness is designed for a first SOC 2 examination. It is $4,500 per month and is generally planned for four to six months, depending on the agreed scope and required remediation. If you also want the program run on an ongoing basis, Managed GRC can cover the SOC 2 work as part of its scope.
No. Every Managed GRC and Launch Readiness engagement starts with an initial assessment of your current environment and security program. The $7,500 standalone Readiness Assessment is for companies that want a separate review and written roadmap before deciding on further work.
They are different engagements. Launch is a fixed-period build focused on a first SOC 2 examination. Managed GRC is an ongoing function, including any program build it needs, with recurring reviews, evidence, customer requests, and defined annual service allowances.
Yes. Managed GRC can build a program from the beginning, take over an existing one, or run an established one. We review the current state during scoping and set the scope accordingly.
A named advisor, the recurring work agreed in your statement of work, monthly reporting, and standard service allowances such as up to 12 vendor reviews and 24 standard questionnaire units a year. The full allowance table is on the Services & Pricing page.
Our standard prices are published on the Services & Pricing page. The proposal and signed agreement confirm the scope, allowances, term, and fees for your company.
We document the requested change and agree on its effect on scope, fees, or delivery before carrying out work outside the current engagement.
No. A client contracts separately with the CPA firm performing the examination.
SOC 2 and examination responsibilities
No. Independent CPA firms perform SOC 2 examinations and issue reports. GetComply provides readiness and operating support.
No. The CPA firm determines its procedures and opinion. Required control changes, the observation period, and the examiner's schedule also affect timing.
Yes. We coordinate with the firm the client selects, subject to the terms of the engagement and the firm's independence requirements.
Responsibilities
The advisor maintains the program plan, drafts documents, coordinates reviews, examines evidence, tracks open tasks, and prepares status and examination materials, within the scope of the engagement.
Your advisor works with the people who already own your systems and processes. Your staff provide system facts and evidence, perform normal control activities, and implement technical changes. Management approves scope, policies, exceptions, and risk treatment.
Not necessarily. Approved reports and exports may be sufficient. Any direct access must be justified, approved, and limited.
Not under the standard managed GRC scope. The client's technical staff or chosen implementation provider makes changes. We can describe the gap, track the work, and review the resulting evidence.
Tools and records
Yes, if the tool suits the engagement. We can work with existing platforms or an agreed document-based process.
No customer portal is part of the standard service. We agree on a secure means of exchanging documents and evidence at onboarding.
The customer receives the work products defined in the engagement in a usable format. Ownership, access, retention, and handover terms are set in the customer agreement.
SOC 2 readiness checklist
This checklist helps organize an initial discussion. Checking an item is a self-reported answer, not a determination that the company is audit-ready. Each item should be supported by a real record when appropriate.
0 of 19 items checked
Your answers stay in this browser tab's session storage until the tab session ends. They are sent only if you choose to carry them into the contact form, where you can edit or delete them before submitting.