How Forsys reached SOC 2 Type 2 across all five criteria in four months.
Forsys, a lead-to-revenue consultancy based in Milpitas, California, had an enterprise deal waiting on its report. We built the evidence programme with its security team and supported them through a SOC 2 Type 1 and then a Type 2 report, across all five Trust Services Criteria. The auditor issued the Type 2 report in August 2026, four months after the testing period began.
The lead-to-revenue specialists.
Forsys offers end-to-end consulting across CRM, CPQ, contract lifecycle management, order management, subscriptions, billing and revenue recognition, working with Salesforce (including Agentforce Revenue Management), Conga and Oracle.
It came to SOC 2 with its own security policy set, aligned to ISO/IEC 27001:2022. What it still needed was the report an enterprise deal was waiting on.
What Forsys needed.
Two reports in sequence, with nothing left out of scope.
- 1
A SOC 2 Type 1 report on Forsys’s controls as of 31 March 2026.
- 2
A SOC 2 Type 2 report on a testing period from 1 April to 30 June 2026. It began the day after the Type 1 date, so every control had to be in place and operating before it started.
- 3
All five Trust Services Criteria in both reports: Security, Availability, Processing Integrity, Confidentiality and Privacy.
What we did, step by step.
Forsys brought its own security policies. We reviewed them against the criteria, built the evidence programme with its team and stayed with Forsys and the auditor through both reports.
- 01Kickoff
A kickoff call on 5 February 2026, organised by Forsys’s CISO, to align on scope, timelines and responsibilities.
- 02Scoping
After kickoff we sent our SOC 2 scoping questionnaire. Forsys’s team had it fully filled by 16 February, and a call was set for 26 February to walk through its open points together.
- 03Policy review
In March we reviewed Forsys’s twelve information security policy documents against the SOC 2 Trust Services Criteria. We checked each one for criteria coverage, for the elements it needs and for consistency with the others.
- 04Criteria map
We mapped the security (Common) criteria to the policies that address them, and set out a staged plan for what to do before the audit, within 30 days and before the Type 2.
- 05Evidence checklist
A checklist of 79 evidence items. Each one is mapped to a Trust Services criterion and says what evidence is needed and where to file it.
- 06Evidence folders
A shared folder structure of 15 evidence areas: governance and policies, organisational structure, risk management, human resources, access control, infrastructure and network, change management, encryption and key management, backup and recovery, security operations, incident response, monitoring and logging, data management, third-party vendors, and business continuity.
- 07Type 1
We handed the evidence to the auditor, who issued Forsys’s SOC 2 Type 1 report in April, about ten weeks after kickoff.
- 08Logo set
With the Type 1 in hand, we sent Forsys the AICPA SOC logo set in dark, white and transparent versions for its website.
- 09Testing period
From April to June we gathered the evidence with Forsys’s team, and in July we updated the checklist for the Type 2.
- 10Type 2
We handed the Type 2 evidence to the auditor, who issued Forsys’s SOC 2 Type 2 report in August 2026.
What Forsys has now.
- Forsys’s SOC 2 Type 1 report across all five Trust Services Criteria, describing its controls as of 31 March 2026, issued by the auditor in April 2026.
- Forsys’s SOC 2 Type 2 report across all five Trust Services Criteria, covering 1 April to 30 June 2026, issued by the auditor in August 2026.
- The SOC 2 scoping questionnaire, completed with Forsys’s team.
- A review of Forsys’s policies against the Trust Services Criteria, with the security criteria mapped to the policies and a staged plan through to the Type 2.
- An evidence checklist of 79 items and a folder structure of 15 evidence areas, in a Type 1 version and an updated Type 2 version.
- The evidence package for each report, handed to the auditor.
- The AICPA SOC logo set for Forsys’s website.
Our SOC 1 and SOC 2 journey couldn’t have been made more simple. TCSA guided us throughout and helped us unblock our enterprise deal.
From February to August.
- February 2026
Kickoff on 5 February, organised by Forsys’s CISO. Our scoping questionnaire followed, and Forsys’s team had it fully filled by 16 February.
- March 2026
We reviewed Forsys’s twelve policy documents against the Trust Services Criteria. The Type 1 report describes the controls as of 31 March.
- April 2026
The Type 2 testing period opened on 1 April. The auditor issued the SOC 2 Type 1 report about ten weeks after kickoff, and we sent Forsys the AICPA SOC logo set for its website.
- April – June 2026
We gathered the evidence with Forsys’s team through the testing period, which closed on 30 June.
- July 2026
We updated the evidence checklist for the Type 2.
- August 2026
The auditor issued Forsys’s SOC 2 Type 2 report, four months after the testing period began.
Is a deal waiting on your SOC 2 report?
Tell us where your controls stand today and which criteria your customers expect. We will plan the Type 1 and the Type 2 with you, drawing on 1,000+ audits and 300+ SOC 2 engagements.
Related Reading
Trust Services Criteria
Security, Availability, Confidentiality, Processing Integrity, Privacy.
Read moreMoving from SOC 2 Type 1 to Type 2
What changes when design testing becomes operating-effectiveness testing, and when the window should start.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreType 1 vs Type 2
Which report to get first, and when to go straight to Type 2.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more