Our services

SOC 2 Readiness, ISO Internal Audits, vCISO & Vendor Risk

SOC 2 audit readiness, independent ISO 27001 and ISO/IEC 42001 internal audits, vCISO leadership, and third-party risk management tailored to your organization. Advisory work and internal audits remain separately scoped to protect audit independence.

Book a call Check Your Audit Readiness - Free

Audit preparation

SOC 2 Audit Readiness

Prepare your organization for a SOC 2 Type I or Type II examination with a clear scope, practical control gap assessment, and evidence review aligned with applicable Trust Services Criteria. Prioritize the work that matters before engaging your independent CPA firm.

Typical engagement scope

✓Confirm system boundaries and applicable Trust Services Criteria
✓Assess control design, ownership, and implementation gaps
✓Review policies, procedures, and supporting evidence
✓Develop a prioritized remediation roadmap and evidence collection plan
✓Plan Type I readiness or Type II observation-period evidence requirements

Information security

ISO 27001 Internal Audit

Independent evaluation of your ISMS against ISO/IEC 27001, your defined audit criteria, and your own documented processes.

Typical audit coverage

✓Clauses 4–10 and applicable controls
✓ISMS scope, risks, objectives, and governance
✓Operational evidence and control effectiveness
✓Prior findings and corrective actions

Artificial intelligence

ISO/IEC 42001 Internal Audit

Independent evaluation of your AIMS, with focused attention on AI governance, risk, impacts, lifecycle controls, and monitoring.

Typical audit coverage

✓Clauses 4–10 and applicable controls
✓AIMS scope, AI policy, roles, and objectives
✓AI risk and impact assessment evidence
✓Lifecycle, supplier, monitoring, and review records

Security leadership

vCISO

Virtual Chief Information Security Officer support that connects security strategy, governance, and risk decisions to your business priorities, without requiring a full-time executive hire.

Typical engagement scope

✓Security strategy and a business-aligned roadmap
✓Risk prioritization and executive reporting
✓Security governance, policies, and accountability
✓Ongoing guidance for leadership and internal teams

Vendor assurance

Third-Party Risk Management

Conduct vendor risk assessments based on your business context, vendor criticality, data sensitivity, system access, and service dependencies. Focus review effort on the relationships that matter most.

Typical engagement scope

✓Review SOC 2 reports and ISO compliance artifacts for scope, relevance, exceptions, and evidence gaps
✓Evaluate Standardized Information Gathering (SIG) and Consensus Assessments Initiative Questionnaire (CAIQ) responses
✓Develop vendor questionnaires tailored to your business, risk level, data types, and access requirements
✓Document findings, follow-up evidence requests, and remediation priorities
✓Define risk-based reassessment and ongoing vendor review schedules

Internal audit deliverables

A defensible record of independent review.

Risk-based audit plan

Evidence sampling and interviews

Clear findings and observations

Formal report and closing discussion

Tuan Security Group does not issue certifications and is not a certification body. Internal audit findings are based on the agreed audit scope, criteria, and evidence sampled.

Need to confirm scope and timing?

Discuss your SOC 2 readiness, internal audit, vCISO, or vendor risk needs and agree a scope aligned with your business. SOC 2 readiness is advisory support, not an attestation examination; your independent CPA firm performs the examination and issues the report.

Book a call