SOC 2 Examinations for SaaS Companies
Licensed CPA firm. Direct partner access. Big 4 and enterprise security background.
Enterprise prospects often require SOC 2 before signing contracts. Get a credible, AICPA-standard report from a CPA who actually understands your tech stack — without an enterprise audit bill.
Why Tang Advisory
Most SOC 2 auditors come from one of two backgrounds: CPA firms that bring in IT consultants, or cybersecurity consultancies that partner with CPAs to issue reports. Tang Advisory brings both in one person — a licensed CPA with deep, hands-on cybersecurity expertise.
I've worked in Big 4 audit (PwC), served as lead assessor on SOC 2 examinations at Coalfire for AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, Oracle Cloud, and IBM Cloud, and built cloud infrastructure at AWS. My background spans the full stack — from auditing the largest hyperscalers in the world to hands-on cloud security engineering. When I examine your controls, I'm not checking boxes — I'm evaluating your architecture with the same depth as your security team.
You won't spend hours explaining your cloud infrastructure to your auditor. I speak your language.
Credentials
Selected professional credentials across audit, security, cloud, and privacy. Current status is verified during engagement acceptance.
CPA
WA since May 2014; OR since February 2026
CISSP
Cybersecurity
CISM
Security Management
CRISC
Risk & Controls
CCSP
Cloud Security
CIPP/US
Privacy Law
CIPM
Privacy Management
HITRUST CCSFP
Healthcare Security
AWS Security Specialty
Cloud Security
AWS SA Professional
Architecture
SC-100
Microsoft Cybersecurity Architect
AZ-500
Azure Security Engineer
How It Works
A clear, predictable process from initial call to signed report.
Step 1: Preliminary Scope Discussion
Free, 30 minWe discuss intended report users, the system boundary, applicable Trust Services Categories, report type, and timing. Any engagement remains subject to formal client acceptance, independence, competence, staffing, quality-review, and firm-readiness gates.
Step 2: Readiness Gap Assessment
Separately scoped, if appropriateA separately scoped assessment can identify factual gaps against agreed criteria. Management retains responsibility for all decisions and for designing, implementing, and operating controls. Before Tang Advisory performs both readiness and an examination, the firm evaluates whether the services are permissible and whether independence safeguards are sufficient.
Step 3: Examination
Scheduled only after required gates are completeFormal SOC 2 examination — walkthroughs, evidence review, control testing. You work directly with me throughout.
Step 4: Report Delivery
Signed SOC 2 Type I or Type II report, ready to share with enterprise prospects and procurement teams.
Type I vs. Type II
Type I
A Type I examination evaluates whether controls were suitably designed and implemented as of a specified date. Timing depends on scope, evidence readiness, identified matters, and completion of the firm's required quality gates.
Best for:
- Closing an enterprise deal quickly
- Establishing initial SOC 2 compliance
Type II
Controls tested over a 3-12 month observation period. Higher assurance. Some buyers accept a shorter 3-month first window, but many enterprise security teams require 6-12 months — confirm with your buyer before locking the window.
Best for:
- Fortune 500 procurement requirements
- Regulated industries
- Demonstrating sustained security posture
Most companies start with Type I and graduate to Type II.
Who I Work With
I work primarily with SaaS companies from seed stage through Series C, and bootstrapped B2B software companies selling to enterprise customers.
Built for High-Growth SaaS
Large audit firms do excellent work — for companies that need enterprise pricing and rotating teams. If you're a 20-200 person SaaS company that needs a credible, AICPA-standard SOC 2 report with direct partner access and a CPA who understands your infrastructure, you're in the right place.
SOC 2+ add-on frameworks
One examination, one report, extra criteria. “SOC 2+” is market shorthand for a SOC 2 examination that addresses additional subject matter and criteria. You map your controls to a second framework your buyers ask about; we evaluate the mapping, test the controls, and report, in an attestation report issued by a licensed CPA firm under the AICPA's attestation standards (AT-C 205) and SOC 2 guide. We can share a template crosswalk, but the mapping is management's.
Nine add-ons and one companion report. Where the add-on uses publicly available criteria, scope grows only by the additional testing; CSA STAR and SOC 1 involve separate steps noted on their pages.
| Add-on | Who asks for it | What the report says | Criteria | Details |
|---|---|---|---|---|
| Most requested | ||||
| SOC 2 + HIPAA | Healthtech, any business associate | Controls tested against the HIPAA Security Rule safeguards as additional criteria | Public standard | Details |
| SOC 2 + NIST CSF 2.0 | Mid-market buyers, cyber insurers, boards | Controls mapped to NIST CSF 2.0 subcategories across all six functions, including Govern | Public standard | Details |
| CSA STAR AttestationAvailable once Tang Advisory’s CSA listing is complete. | Cloud buyers who check the STAR registry | SOC 2 plus the Cloud Controls Matrix, eligible for a STAR Level 2 listing on the CSA registry | Public standard | Learn more |
| SOC 2 + NIST 800-171 | Defense and government subcontractors | NIST SP 800-171 Rev 2 (110 requirements, the version DoD currently requires under DFARS 252.204-7012 and CMMC Level 2). Evidence behind your SPRS self-assessment; not a CMMC certification and not a C3PAO assessment | Public standard | Details |
| SOC 2 + AI governance | AI products facing enterprise procurement | AI-system controls tested against objective control statements: the CSA AI Controls Matrix where eligible, or management-defined statements referencing NIST AI RMF | Public standard | Details |
| Also available | ||||
| SOC 2 + ISO 27001-aligned | Buyers who accept a bridge while you pursue certification; many EU buyers will still require the certificate | Controls mapped to ISO 27001:2022 Annex A. A bridge, not an ISO certificate | ISO/IEC 27001:2022 Annex A (licensed text) | Details |
| SOC 2 + Privacy | SaaS handling EU personal data or in-scope CCPA data | Opinion covers the Privacy category (P1 to P8); GDPR and CCPA mapping presented as management’s other information | Public standard | Details |
| SOC 2 + PCI DSS mapping | SaaS touching card data below Level 1 | Controls mapped to PCI DSS v4.0.1 requirements. Supports your SAQ, not a Report on Compliance; not an ASV scan, and not a QSA signature if your acquirer requires one | Public standard | Details |
| SOC 1 companion report | Fintech, payroll, anything feeding a customer’s financial statements | SOC 1 (AT-C 320) Type I or II. A separate report for your customers’ financial-statement auditors, with its own control objectives and assertion | Public standard | Details |
What a SOC 2+ report is
An attestation report issued by a licensed CPA firm under the AICPA's attestation standards (AT-C 205) and SOC 2 guide. The added framework is tested as additional criteria in the same examination, so you get one report and one fieldwork window. We do not design, implement, or operate the controls we examine.
What it is not
Not an ISO 27001 or ISO 42001 certificate, which only an accredited certification body can issue. Not a CMMC certification, a HITRUST report, or a PCI Report on Compliance. Where a buyer needs one of those, we say so up front.
Related assessments
Separate deliverables that are not SOC 2+ add-ons but are often asked for alongside a SOC 2.
- Details
Microsoft SSPA independent assessment
A separate letter on Microsoft’s required template against the Data Protection Requirements. Not a SOC 2+ section
Frequently Asked Questions
Licensure & Verification
Tang Advisory is the trade name of Tang Enterprises LLC, a Washington-registered CPA firm (WA firm license #59422). George Tang is a licensed CPA in Washington (#32532; original issue date May 13, 2014) and was granted Oregon license #17555 on February 2, 2026. Verify current license status at CPAVerify or the Washington State Board of Accountancy.
Based in the Pacific Northwest. Serving SaaS companies nationally.
Ready to discuss a SOC 2 examination?
Schedule a free 30-minute preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.