Plaidnox . TITLE . ID

01 . Overview

Readiness Summary

Plaidnox InfoSec completed a SOC 2 Type II readiness assessment for [REDACTED] covering all five Trust Services Criteria (TSC): Security (CC), Availability (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P). The assessment reviewed 89 control points across the five criteria.

The overall readiness score is 63% with 56 controls demonstrating adequate evidence and 33 controls presenting gaps. Of the 33 gaps, 6 are rated Critical (likely to result in a qualified opinion if unresolved), 12 High (significant control weakness), and 15 Medium/Low. The planned Type II observation window should be delayed until Critical and High gaps are addressed.

02 . Trust Services Criteria Coverage

Criteria breakdown

Controls Assessed

Controls Adequate

Gaps (Critical+High)

63%

Readiness

Criteria	Controls	Adequate	Gaps	Status
Security (CC)	47	28	19	Not Ready
Availability (A)	14	12	2	Near Ready
Confidentiality (C)	12	8	4	Partial
Processing Integrity (PI)	11	6	5	Partial
Privacy (P)	5	2	3	Not Ready

03 . Critical Gaps

Critical and High gaps requiring remediation

ID	Criteria	Gap	Priority
GAP-001	CC6	No formal access review process . privileged access not reviewed quarterly	Critical
GAP-002	CC7	Vulnerability management programme absent . no documented scan or remediation process	Critical
GAP-003	CC8	Change management process not formally documented or consistently followed	Critical
GAP-004	P1	Personal data inventory incomplete . data flows undocumented for 3 of 5 processing activities	Critical
GAP-005	CC9	Vendor risk management . 14 critical vendors have no security questionnaire on file	Critical
GAP-006	CC5	Risk assessment not formally conducted in last 12 months	Critical
GAP-007	CC6	MFA not enforced for remote access to production systems	High
GAP-008	CC7	Intrusion detection absent on production network segment	High

?Full gap documentation for GAP-009 through GAP-033 is provided in the detailed annexe delivered under engagement agreement.

04 . Remediation Roadmap

Path to SOC 2 readiness

?Timeline: All 6 Critical gaps must be closed before the Type II observation window begins. Minimum 8-week remediation window recommended before engaging the external auditor.

Gap	Action	Timeline	Owner
GAP-001	Implement quarterly access review with documented sign-off process	Wk 1-3	IT / Compliance
GAP-002	Deploy vulnerability scanner; document scan cadence and SLA remediation policy	Wk 1-4	Plaidnox / IT
GAP-003	Formalise change management policy and implement approval workflow in Jira	Wk 2-4	Engineering Lead
GAP-004	Complete GDPR/data flow mapping using Plaidnox Data Inventory template	Wk 3-6	DPO / Compliance
GAP-005	Send security questionnaire to top 14 critical vendors; document responses	Wk 2-8	Procurement
GAP-006	Conduct annual risk assessment using ISO 27005 methodology; document register	Wk 4-6	Plaidnox

Conclusion

SOC 2 Type II observation window should be delayed until the 6 Critical gaps are closed

At 63% readiness, [REDACTED] is not currently in a position to begin a SOC 2 Type II observation window without significant risk of a qualified or adverse opinion. An 8-12 week remediation programme addressing the Critical and High-priority gaps is required before engaging the external auditor. Plaidnox will provide evidence gathering support and a re-validation assessment at the end of the remediation cycle.

Plaidnox InfoSec . PLX-2025-012

Confidential . Authorised Distribution Only

SOC 2 Type II Readiness[REDACTED]

Readiness Summary

Criteria breakdown

Critical and High gaps requiring remediation

Path to SOC 2 readiness

SOC 2 Type II Readiness
[REDACTED]