Controls per system
Not a shared spreadsheet with last year’s owner still in the cell.
Solutions · Startups
Get the register in order before you hire an auditor.
You do not have a GRC team. You have a product, a cloud account, and a buyer who asked for SOC 2. ReadyComply is the register for that first cycle — not a certificate you purchase.
Who this is for
A founder who needs a system boundary, not a slogan.
Name the entity. Name the product. Instantiate Security. File what you already have. Open tasks for what you do not. That is the whole first pass. Platforms that skip this and sell a badge are selling someone else’s opinion.
The first pass
Five moves. None of them are “get certified.”
- 01
Name the legal entity and the systems in scope.
If you cannot draw the boundary, you are not ready for a firm.
- 02
Instantiate starter Security criteria and assign owners.
On a five-person team the owner is often you. Write that down.
- 03
Write what is implemented today. Mark what is not.
Honesty here is cheaper than a finding in the period.
- 04
File evidence by hand. Open tasks for the gaps.
Connectors come later. The loop has to work without them.
- 05
Bring your own CPA.
ReadyComply is not the firm, does not pick one, and does not issue the report.
What you get
The same workspace Authio is using on itself.
Evidence with a date
The export you already ran, filed against the control it supports.
Versioned policies
What you claim you do, next to the criterion it maps to.
Remediation with a due date
Gaps are work. Work has an owner.
Also in ReadyComply
Open these pages next.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Start the first system. Then stop calling it certified.
Sign in. If you are in the portfolio, you already have an organization.
Sign in