How we would rank SOC 2 readiness firms

The listings here are not in quality order. This is the scoring we would use if we ranked them, published so you can run it yourself on whichever firms you are considering.

Last reviewed 2026-09-18Written by Jacob Masse, TrazTech Inc.

This directory does not rank firms by quality. What it does instead is described exactly below, along with the scoring we would use if we did, because a buyer working through a shortlist needs a method more than they need our opinion. Everything in the scoring is something you can check yourself in about an hour.

A ranked list would also be the easiest thing here to get wrong. The signals that are simple to collect, years in business, number of logos, certifications held, are weak predictors of how an engagement goes. The signals that predict it well, who does the work and whether the fee assumes anything about your environment, are only visible in a conversation.

How the order actually works today

The listing order is mechanical and it is not for sale. In sequence:

1. The operator sorts first. TrazTech Inc. runs this directory and is also a listed firm, so its row appears above the others. That is a thumb on the scale and it is disclosed on the row itself, in the section heading, and here.
2. Verified listings. Firms that pay for a Verified listing and have had their details checked.
3. Claimed listings. Firms that have claimed their profile and keep it current, at no charge.
4. Everything else, alphabetically. Firms listed because they do the work, whether or not they have ever been in touch.

Position within a band is alphabetical by name. There is no engagement scoring, no editorial preference and no pay-for-placement inside a band. A Verified listing buys the badge, a profile the firm controls, and a place in the quote routing. It does not buy an opinion about the firm's quality, because we have not formed one about most of them.

The scoring we would use

If this list were ranked, these are the signals and the weights. They are ordered by how much they predict, which is close to the reverse of how easy they are to collect.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Why these signals and not the usual ones

Years in business, headcount and client logos are the three most commonly displayed facts about a consultancy and they carry almost no information about your engagement. A firm can be fifteen years old and put a first-year associate on your work. A logo wall says a company bought something once, not that the work went well or that the same people are still there.

What the signals above have in common is that each one is answerable with a specific fact, and a firm that cannot produce the fact has told you something useful by failing to.

Reference calls outrank everything

Twenty minutes with a company that finished the work six months ago tells you more than every proposal you will read. Ask what existed at day 90 that did not exist at day 1, what the firm told them not to do, and whether the hours landed where the proposal said.

Pricing structure is a proxy for honesty about uncertainty

Remediation depends on what an assessment finds. A firm pricing it in advance has either padded for the worst case or will be back for a change order. Two phases, priced separately, is the structure that does not require either.

Named people beat named firms

The most common quiet disappointment in this market is a senior person selling and a junior person delivering. The fix is to write the name and the hours into the statement of work, and a firm that will do that is offering you something checkable.

Statutory fluency cannot be revised into a website

Canada has no single private-sector privacy law. PIPEDA applies federally, Quebec, Alberta and British Columbia have their own, and Ontario health information sits under PHIPA. A firm working from material written for another country gets this wrong in a first conversation.

What we deliberately do not score

• Price. The cheapest defensible quote and the most expensive one can both be right, because they are pricing different assumptions about you. Compare structures rather than totals, and see what drives a SOC 2 quote.
• Size. A boutique with two practitioners and a national firm with two hundred are different purchases with different failure modes. Neither is better in the abstract.
• Speed. A firm promising a faster result than the observation window allows is describing a Type 1, or is describing something that will not survive the examination. The calendar is set by the report type, not by effort.
• Platform partnerships. Many firms are resellers or referral partners for compliance platforms. That is not disqualifying, and undisclosed it is. Ask.

What a weak answer sounds like

The scoring above is only useful if you can tell a real answer from a practised one. These are the responses that should lower a score rather than raise it, and none of them is a refusal.

None of these is disqualifying alone. Two or three together, from the same firm, is a pattern, and the pattern is usually that the proposal was written by somebody who will not be doing the work.

How to use this on a shortlist

Take three firms, ask all of them the same questions in the same order, and write the answers down as you get them. The point is not that any single answer disqualifies anybody. It is that three firms answering the same questions are comparable and three firms answering whatever came up on the call are not.

Two questions do most of the work if you only have time for two: which Canadian engagement can you refer me to, and is remediation priced before or after the gap assessment. The rest of the list is confirmation.