The article
A deal is waiting on a report. Your biggest prospect wants a SOC 2 report before it signs, a partner asks for an ISO 27001 certificate, or your payment processor wants your PCI DSS paperwork. Cybersecurity audit consulting gets you ready for that day: we run a mock audit, close the gaps it finds, gather the evidence and stay with you through the real audit.
I have been building software for 18 years, and since 2017 my team of 70+ specialists has delivered 150+ projects. In audit consulting we sit on your side of the table. The auditor checks; we help you prepare, answer and fix. The certificate or the attestation itself always comes from an independent auditor. No part of our cybersecurity practice issues one.
Cybersecurity audit consulting: the short version
| What | How it works |
|---|---|
| For whom | Companies facing a SOC 2, ISO 27001, PCI DSS or client security audit |
| Before the audit | A mock audit, the gaps ranked, the fixes made, the evidence collected and filed |
| During the audit | Help answering the auditor's questions, finding the evidence they ask for and fixing what they flag before the report is final |
| Who issues the result | An independent auditor |
| When to start | As soon as the audit date is known |
| Price | The first call and the rough estimate are free; the work is estimated before it starts |
Who issues what
The result of an audit comes from someone independent of you and of us; we help you before and during it. Who that someone is depends on the audit:
| Audit | Who issues the result | What you decide | What we do |
|---|---|---|---|
| SOC 2 | A licensed CPA firm issues the report | The auditor, the criteria and the period | Mock audit, fixes, evidence, support during fieldwork |
| ISO 27001 | An accredited certification body issues the certificate | The scope of your management system | Gap review, controls, the internal audit, support through the certification audits |
| PCI DSS | A Qualified Security Assessor, or your own self-assessment questionnaire | Ask your acquiring bank or payment processor which one applies | Card data kept out of your systems where possible, the rest secured, the evidence prepared |
| A client's audit | The client's security team | Who answers which questions | Answers drafted, evidence found, weak spots fixed first |
An auditor is expected to stay independent of the controls it checks, so the firm that helped you build and fix them should not be the one that signs the report. If the same firm offers you both, ask how its independence rules apply. For the standards themselves, see ISO 27001 consulting and PCI compliance.
SOC 2 or ISO 27001: which one first
Start with the one your buyers ask for in writing; the two answer the same worry in different forms. A SOC 2 report is an attestation a CPA firm writes under AICPA standards, and your client reads the report itself, including any exceptions the auditor found. An ISO 27001 certificate says that an accredited body checked your information security management system against an international standard.
| SOC 2 | ISO 27001 | |
|---|---|---|
| What you get | A report your clients read | A certificate, plus the audit behind it |
| Who issues it | A licensed CPA firm | An accredited certification body |
| What it covers | The controls of the services you choose to put in scope | Your whole management system for the scope you set |
If buyers ask for both, much of the evidence overlaps, and one set of controls can serve both audits.
Audit readiness, step by step
Readiness takes four steps, and the first one decides the rest:
- Mock audit. The questions an auditor will ask, answered against your real systems.
- Gaps. What would fail, ranked by how much it matters.
- Fixes. Controls put in place, and policies written so that people follow them. Gaps in code and cloud settings can go to our developers and DevOps engineers through cybersecurity remediation.
- Evidence. Logs, records and screenshots collected and filed where the auditor will look for them.
What a mock audit asks
A mock audit asks the auditor's questions before the auditor does, and accepts only what an auditor would accept: evidence from your real systems. Forward these five to whoever owns IT and see how fast the answers come back.
| The question | Evidence that holds |
|---|---|
| Who has administrator access, and when was the list last reviewed? | An export from the system, with the review dated and signed off |
| Did the last person who left lose access on time? | The leaving date next to the date each account was closed |
| How does a code change reach production, and who approved it? | The change request, its review and the deployment record |
| When was a backup last restored? | A dated restore test, with how long it took |
| Which vendors hold your data, and how did you check them? | A vendor list with a review of each |
Why some controls need months of records
An auditor wants to see a control work over time, not only on the day of the visit. A SOC 2 Type 1 report looks at how your controls are designed; a Type 2 report also tests whether they operated over a period. One access review done the week before the audit proves you can do it, not that you do it, which is why the best day to start is the day the audit date is known.
Evidence that a system produces by itself holds up better than screenshots collected by hand. On RxPhoto, a before-and-after photo platform for clinics whose backend we worked on, an audit log lets administrators show who opened which record and when. For PBM Source, compliance software we developed for pharmacy benefit managers, each new requirement arrives as a task with its documents in one place, so nothing is decided in scattered emails. When the same evidence is needed every quarter, compliance automation collects it on its own.
Red flags before an audit
Forward this list to whoever is choosing your audit help:
| Red flag | Why it hurts | Ask for instead |
|---|---|---|
| A promise that you will pass | Only the auditor decides the result | What happens when the mock audit finds a gap |
| Policies copied from a template | Auditors test what people do, not what the paper says | Policies written around how your team works |
| Evidence gathered the week before | It shows a control exists, not that it worked over time | Evidence collected from the day the date is set |
| A SOC 2 report promised fast and easy | In 2026 the AICPA warned that such promises threaten the credibility of SOC reports | A licensed CPA firm enrolled in peer review, and a list of what it will test |
| The firm that builds your controls also signs the report | The auditor is expected to stay independent | Separate firms for preparation and for the audit |
| Nobody owns the fixes after the auditor leaves | Next year's audit finds the same gaps | A named owner and a date for every finding |
The AICPA, which sets the standards for SOC reports, ran the warning in February 2026 under a headline saying that promises of "fast and easy" threaten SOC credibility. A report your client trusts is worth more than one that arrived quickly.
During the audit: someone on your side of the table
During the audit we help answer the auditor's questions, find the evidence they ask for and fix what they flag before the report is final. The auditor talks to the people who run each control; our job is to make sure they know what the question means and where the evidence is. When the auditor asks for something new, you have someone who already knows where everything is filed.
What we need from you
Audit preparation runs on your people's time as much as on ours. Plan for:
- one person on your side who owns the audit and answers our questions quickly;
- the owners of each control: IT, development, and whoever handles hiring and leaving;
- read access to the systems in scope;
- the auditor's request list, as soon as you have it.
It starts with a free first call; if you need an NDA, we sign it before you share details. On weekdays from 9 am to 6 pm Miami time, we reply to a new request within 30 minutes.
What audit preparation costs
Every audit preparation is estimated before work starts, and the first call and the rough estimate are free. The price depends on:
- the standard, and for SOC 2 the criteria you choose;
- the scope: systems, locations and people;
- how many controls and records exist already;
- whether our engineers also fix code and cloud gaps;
- how long we stay with you through the audit.
Price pages are rare in this field. Of the five audit pages I measured from Google's first page in October 2026, none publishes a price, and two say plainly who issues the certificate. Five pages are a small sample, so ask any firm both questions before you sign, us included.
After the audit
An audit is passed once, and then the controls have to keep running until the next one. If you have no controls to speak of yet, start with a security assessment instead.
If several frameworks ask for the same things, cybersecurity compliance consulting maps one set of controls to all of them. And if you want a security lead without a full-time hire, managed cybersecurity consulting keeps the plan moving every month. Everything else we advise on is under cybersecurity consulting.
Tell us when your audit is. We reply with what we would check first and a rough estimate, free.
