SOC 2 compliance has a reputation for being slow, expensive, and heavily dependent on having the right people internally. CyberMark handles the process end-to-end: gap assessment, control implementation, documentation, and audit coordination. NZ-based team, no compliance officer required on your end.
Book Your Free SOC 2 AssessmentSOC 2 compliance is no longer something NZ companies pursue after landing an enterprise client; it is what gets them in the door in the first place.
Enterprise procurement teams now include SOC 2 in their vendor assessment checklists. Financial institutions, healthcare organisations, and government agencies regularly ask for a current SOC 2 Type 2 report before agreeing to share data or systems access with a third-party provider. Without one, your sales team cannot progress past the due diligence stage, regardless of how good your product or service actually is.
SOC 2 is built around five Trust Service Criteria. Security is required in every audit. The others are scoped in based on your business model and what your customers need from you.
Every SOC 2 audit includes this one. It looks at how your organisation controls access to systems, monitors for threats, manages incidents, and handles changes to your environment. Think of it as the foundation everything else sits on.
Comes into play when your customers depend on your platform to run their own operations. If downtime on your end creates a problem on theirs, auditors will want to see that your uptime commitments are backed by actual controls, not just an SLA document.
Relevant if your systems handle financial transactions, payroll, or any workflow where an error in processing has real consequences. This criterion checks that data moves through your systems accurately, completely, and with proper authorisation at each step.
Broader than privacy. This covers any information your business has committed to keeping confidential — commercial data, legal documents, and client records — and how that information is stored, shared, and eventually destroyed.
Specifically about personal information and the lifecycle it goes through in your systems: what you collect, why you collect it, how long you keep it, and how it leaves. For NZ businesses, this maps directly to your obligations under the NZ Privacy Act 2020 and GDPR.
Not every NZ business has the internal resources or expertise to navigate a SOC 2 audit without support. CyberMark works alongside your team at every stage.
We map your current security controls, policies, and procedures against SOC 2 requirements and identify exactly where gaps exist. You receive a clear, prioritised remediation roadmap — no vague recommendations, no generic templates.
Our team works with you to implement the controls required for your audit scope. This includes access management, monitoring configurations, incident response procedures, change management documentation, and staff security training. We handle implementation directly or work alongside your internal IT team.
SOC 2 auditors examine policies, procedures, access logs, change records, incident reports, and system configurations. We prepare your documentation package to meet auditor expectations, so nothing delays your report.
We do not conduct the SOC 2 audit itself — audits must be performed by an independent CPA firm accredited by the AICPA. We help you select the right auditor for your scope and budget and work directly with them throughout the engagement to streamline the process.
Passing the audit is the beginning, not the end. Controls must operate consistently throughout the next audit period. Our ongoing compliance reporting and 24/7 security monitoring keep your controls active and your documentation current year-round.
SOC 2 compliance requirements reach further than many NZ businesses expect. If your organisation processes, stores, or transmits customer data as part of service delivery, a SOC 2 report is likely on the horizon.
SaaS and technology companies — particularly those selling to enterprise clients in the US, Australia, or the UK
Managed service providers (MSPs) — customers want proof that the partner managing their systems has verified security controls
Fintech and payment processors — SOC 2 works alongside PCI DSS to satisfy financial sector security requirements
Healthcare technology vendors — SOC 2 complements HIPAA compliance for vendors operating in or alongside the US health sector
Cloud infrastructure and data hosting companies — enterprise customers require documented evidence of access controls and availability commitments
Professional services firms — legal, accounting, and HR technology companies handling sensitive client data face growing pressure to demonstrate compliance
SOC 2 auditors review controls across people, processes, and technology. Meeting the requirements is not a single-step exercise; it involves demonstrating that controls operate consistently across the full audit period.
Who has access to what, when was it last reviewed, and what happens when someone leaves or changes roles. Auditors look for a documented, repeatable process, not a spreadsheet someone updates occasionally.
Logs need to run continuously, not just during business hours. For NZ businesses without an internal security team, our Managed Detection and Response (MDR) service covers this requirement directly.
A written plan is not enough. Auditors want to see that the plan has been tested and that past incidents have documented outcomes. An untested response plan is a common audit finding.
Every change to an in-scope system needs a paper trail: who requested it, who approved it, and how it was tested. Ad hoc changes with no documentation will create findings.
A structured process for identifying risks to your systems and data, evaluating their likelihood and impact, and recording what you decided to do about each one.
If a third party has access to your systems or customer data, you need documentation showing they were assessed before onboarding and are reviewed on an ongoing basis.
Training records showing employees understand their responsibilities, supported by regular phishing simulations that demonstrate the programme is active, not just a one-time exercise.
Every person working on your engagement operates from New Zealand. We understand the NZ Privacy Act 2020, the local regulatory landscape, and what a growing NZ technology company actually looks like when it is trying to close its first enterprise deal.
Many compliance consultants hand you a gap report and leave you to figure out remediation. CyberMark implements the controls directly through our managed security services, meaning your readiness work and your ongoing security posture are managed by the same team.
Our services are structured around what your business actually needs at each stage of the compliance journey. Month-to-month arrangements mean you are not paying for ongoing support you do not need after your audit completes.
Our 24/7 monitoring, endpoint protection, and compliance reporting capabilities mean your SOC 2 controls are maintained by the same systems protecting your business every day — not a separate compliance tool you have to manage independently.
Fixed-scope pricing for NZ businesses preparing for their first SOC 2 audit. Every engagement includes direct support from our NZ-based team.
one-time assessment
implementation support
full audit preparation
Already have managed security in place? Our gap assessment may cost less — overlapping controls reduce the work required.
Everything you need to know about SOC 2 compliance
SOC 2 requires your organisation to design and operate controls that protect customer data across the Trust Service Criteria relevant to your scope. At minimum, this means implementing and documenting security controls covering access management, monitoring, incident response, change management, and risk assessment. A Type 2 report also requires those controls to operate consistently for a minimum of six months before the audit.
No, SOC 2 is not required by NZ law. But that distinction matters less than it used to. Enterprise customers in the US, Australia, and the UK now routinely include it as a contractual condition, meaning your legal exposure is not the issue; your ability to close deals is. In most sectors, it has quietly shifted from a differentiator to a baseline expectation.
SOC 1 addresses controls relevant to financial reporting. SOC 2 covers security, availability, processing integrity, confidentiality, and privacy controls. SOC 3 covers the same subject matter as SOC 2 but produces a public-facing summary report rather than a detailed audit document. Most enterprise customers request SOC 2 specifically.
SOC 2 Type 2 reports typically cover a 12-month observation period and are renewed annually. Enterprise customers and partners often request reports covering the most recent 12-month period as part of their ongoing vendor management process.
SOC 2 audits must be conducted by an independent CPA firm accredited by the AICPA. CyberMark is not an auditor; we prepare your business for the audit and work directly with your chosen auditor throughout the engagement.
The difficulty depends entirely on your current security posture. Businesses with existing security controls, documented policies, and active monitoring are significantly closer to audit-ready than those starting from scratch. CyberMark's gap assessment gives you a clear picture of where you stand and how long your readiness work will realistically take.
No. They address similar subject matter but are different frameworks with different audit structures and outputs. SOC 2 is US-based and produces an auditor's attestation report. ISO 27001 is international and produces a certification. Many NZ businesses benefit from aligning both.
CyberMark works with NZ businesses at every stage, from the first gap assessment through to maintaining compliance year after year. Whether you are starting your first SOC 2 audit or trying to recover momentum after a stalled internal effort, our team can step in and move things forward.
Book Your Free SOC 2 ConsultationWe respond within one business day. Email: [email protected] | Phone: 0273510488