We prepare SaaS products, outsourcing companies and fintechs for SOC 2 Type 1 and Type 2 — and issue the report through the BALTUM group's US-registered CPA firm. Optionally together with ISO 27001, GDPR, Cyber Essentials and NIS2 in one project, or each service on its own.
The BALTUM group's CPA firm registered in the USA with licensed CPA auditors. Issues SOC 1, SOC 2 and SOC 3 reports under AICPA standards (SSAE 18).
Accredited certification body for information security management systems. Certificates are recognised internationally.
We assess and issue Cyber Essentials and Cyber Essentials Plus certificates under the UK NCSC scheme.
Ukrainian consulting team: SOC 2 readiness, ISO 27001 implementation, GDPR and NIS2. Separate from the auditors — to keep the assessment independent.
SOC 2 (System and Organization Controls 2) is an independent auditor's report on how a company protects customer data. It was developed by the American Institute of CPAs (AICPA) and it is what US and Canadian buyers ask for from SaaS vendors, cloud services, software outsourcing and data-processing providers.
For a Ukrainian IT company SOC 2 is the ticket to enterprise customers: without a report the deal is often blocked by the buyer's security team at due diligence. The report shows that your controls operate across the five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
An important detail: SOC 2 is not a certificate you can buy. Only a licensed CPA firm can sign the report. The BALTUM group includes a US-registered CPA firm with licensed CPA auditors — so you get readiness and the report in one place, with a fixed price before you start. Readiness and the audit are performed by separate teams, as AICPA independence rules require.
Every package includes SOC 2 readiness and the audit by the BALTUM group's CPA firm. Choose based on the markets you sell to. Each service can also be ordered separately.
We define the system, TSC categories and report type. Our CPA auditors quote a fixed audit fee from five inputs.
We compare current processes to the TSC and produce a remediation plan with owners and deadlines.
Policies, procedures, cloud configuration, access management, logging, incident and vendor management.
We set up evidence collection (manually or via an automation platform) and run an internal readiness review.
The independent audit team of the group's US CPA firm performs the examination; consultants help with the System Description and auditor requests.
You receive the SOC 2 report. For Type 2 we maintain controls through the observation period and prepare the bridge letter.
We work to the AICPA TSC and ISO 27001. Controls are designed to actually operate in your infrastructure, not just on paper.
SOC 2 reports are issued by the BALTUM group's US-registered CPA firm with licensed CPA auditors. No intermediaries: you know the audit fee before signing, and the report is accepted in the US and Canada.
SOC 2, ISO 27001, GDPR and Cyber Essentials share a common control core. We map requirements to each other so your team never does the same work twice.
The group includes an internationally accredited ISO/IEC 27001 certification body and a Cyber Essentials certification body. Certificates accepted in Europe and the UK — from one source.
Project team in Ukraine, contract with Baltum Büroo OÜ (Estonia). Telegram, online meetings, documents in Ukrainian or English.
A SOC 2 report lives 12 months. We keep controls healthy, prepare the annual Type 2 and help answer customer security questionnaires.
The TSC are the foundation of every SOC 2 report. We explain what each of the five criteria means, which controls sit behind them and how to define your audit scope.
Read more →A SOC 2 report has a shelf life. We explain what a bridge letter is, how to plan your next observation period and what to do monthly, quarterly and annually so the next audit has no surprises.
Read more →SOC 2 is an attestation report for the US market; ISO 27001 is an international certificate. We compare structure, cost and timelines and explain when to do both.
Read more →Five fields — exactly what our CPA auditors need to quote a fixed audit fee. We reply within one business day.