We select the Trust Services Criteria that fit your service commitments, design controls that generate evidence as a byproduct of normal operations, and run the readiness assessment before your auditor does. The goal is a clean Type II report, not a scramble in week three of the observation period.
Security is required. Availability, confidentiality, processing integrity and privacy are choices. Each one you add is more controls, more evidence and more audit cost, so the criteria you select should be the ones your customers actually ask about.
Type I says the controls were designed properly on a date. Type II says they operated across a period. Enterprise buyers increasingly skip straight to asking for Type II, which means the observation window is the real project.
You cannot manufacture three months of access reviews in the last week of the observation period. Controls have to be designed so the record accumulates while people do their jobs.
Procurement will not proceed without one, and the timeline is now somebody else's.
You are answering the same forty questions for every prospect, and a report would replace most of them.
Exceptions in the report, or a scramble in fieldwork that nobody wants to repeat next cycle.
We map your service commitments to the Trust Services Criteria that fit them, and we argue against the ones that do not. Scope discipline here saves money in every subsequent cycle.
Access reviews that produce a signed record, change management that leaves a trail in the tooling you already use, monitoring with alerting somebody is accountable for.
A full gap assessment against the selected criteria, remediation, and a dry run of the evidence request list so fieldwork is a confirmation rather than a discovery.
What the report needs to say, and to whom.
What is missing, what gets built, and in what order.
The window where evidence accumulates. This is where most programs quietly fail, and where we stay closest.
We answer the auditor's requests with you, so the request list does not land on one overloaded person.
The ones that come up most often before a scoping call.
Readiness is commonly two to four months depending on how much has to be built. A Type II then requires an observation period, most often three months for a first report and twelve months thereafter. Plan for six to nine months from a standing start to a report in hand.
Not always. A Type I is useful when you need something to show a customer quickly, or when you want an auditor's read on control design before committing to an observation window. If neither applies, going straight to Type II saves a cycle and a fee.
No. The report has to come from an independent CPA firm. We prepare you and support you through fieldwork, and we will happily work alongside the auditor you choose.
Security is mandatory. Availability is the most common addition, usually because a customer contract carries an uptime commitment. Privacy is the one most often added without cause and most often regretted.
The platform collects evidence. It does not decide what your control environment should be, judge whether a control is designed adequately, or argue scope with your auditor. Those are the parts that determine whether the report is clean.
© 2026 CARMhaus Consulting LLC. All rights reserved. Cybersecurity · Assurance · Risk Management
We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.