A customer asked for SOC 2. Start with the evidence they need.
Clarify the customer’s request, the scope of systems involved and who will assess the evidence. Ego Eimi can close agreed technical control gaps and produce auditor-ready evidence; the auditor decides. The right next step depends on the requirement, the evidence requested by that customer.
01 / Clarify the commercial requirement.
Ask for the exact questionnaire, contractual condition or report requested. Confirm which service and systems are in scope, the decision maker and the actual customer deadline. A request for a SOC 2 report, an ISO 27001 certificate and a set of technical controls are different requests.
Bring an auditor or appropriately qualified compliance specialist in when the scope requires one. Software work alone cannot establish organizational certification.
02 / Map each agreed gap to an owner and evidence.
| Technical area | Example evidence to agree with the assessor |
|---|---|
| Access | Account inventory, role decisions, joiner/leaver records and review evidence. |
| Change control | Approval, test, release and rollback records. |
| Recovery | Backup scope and restoration test results. |
| Dependencies | Inventory, patch decisions and unresolved findings. |
| Incidents | Detection, escalation, response and review records. |
| AI exposure | Approved data use, tools, permissions, evaluations and fallback. |
These are examples for scoping. They are not a complete control framework or a claim that the controls have been implemented.
03 / Keep the evidence connected to the actual system.
A written policy should match what people and systems do. Close the technical gap, verify the result and retain the evidence in the Operations Record. Assign responsibility for maintaining it after the customer questionnaire is submitted.
A pure paperwork engagement with no ongoing software responsibility is outside our fit. We can work alongside the appropriate auditor or compliance adviser when the business needs someone to operate the systems.
04 / Choose a bounded technical scope.
Bring the request and system inventory to Foundation. Read the trust center and AI-use policy for the operating commitments and evidence status.
Editorial review: Ego Eimi · Updated September 6, 2026 · About the team
Your technology
Start with the business
Your business depends on it.
Tell us which system matters, what has changed and who controls it. We will define a reviewable next step. Read Foundation and the commitments and evidence.