SOC 2 Certification Process

The SOC 2 certification process involves a formal, independent audit performed by Maverick Certification Services (MCS).
While organizations may conduct their own readiness activities internally or through independent consultants, our involvement begins only at the official audit stage, as required by international accreditation rules.

Below is the standard SOC 2 certification pathway that organizations typically follow — where MCS performs only the certification audit:

1. Client Readiness Preparation
Organizations prepare their internal controls, documentation, and policies according to the SOC 2 Trust Service Criteria.

2. Evidence Collection (Performed by the Organization)
Organizations prepare or refine their internal policies and controls related to: Data accessIncident response, Change management, Vendor risk System availability, Logical & physical access.All documentation must align with AICPA Trust Principles.

3. SOC 2 Audit – Type I or Type II (Performed by MCS)
Maverick Certification Services performs an independent, evidence-based SOC 2 audit to assess an organization’s adherence to the applicable Trust Service Criteria: Security, Availability, Confidentiality, Processing Integrity, and optional Privacy. The audit examines the suitability of control design for Type I reports and the operating effectiveness of those controls over time for Type II reports.

4. Reporting
Upon successful completion, MCS issues the official SOC 2 Type I or Type II Audit Report, demonstrating the organization’s trust, security posture, and compliance with AICPA Trust Service Criteria.

5. Annual Surveillance or Re-Certification
For ongoing compliance, organizations complete annual SOC 2 activities that include the recurring Type II audit, any required updates to the audit scope, and continuous year-over-year coverage for the defined audit period.