.png)
Book a Scoping Call
Book a Scoping Call
If NRC IRAP has already approved your project, our dedicated IRAP stream makes it straightforward to apply that funding toward building an audit-ready security program.
For IRAP-Funded Companies Building Security Programs
Pick the entry point that matches where you are. We structure every engagement to maximize the IRAP-funded portion within your project window.
A standalone gap assessment of your current state against the SOC 2 Trust Services Criteria. Roadmap, defensible scope statement, and an honest read on whether you are three months or nine months from audit-ready. Useful as a third-party opinion before committing to implementation.
The fixed-scope, fixed-price implementation. 8 to 12 weeks. Working security program, control matrix, custom policies, GRC platform configured if you want one, evidence walkthroughs, and a readiness report. By the end, your team can operate the program without us.
Continuous program management between audit cycles. Weekly cadence calls, evidence collection, vendor reviews, security training, internal audit, and external audit management. Operate is what gets you from Type I to Type II without the program decaying.
Assess + Build + Operate. Annual fixed price that bundles the Build, ongoing Operate work, audit management, and (where applicable) GRC platform license and pen test. One number on the budget line, one accountable team running the whole program.
Four steps from your IRAP contribution agreement to a SOC 2 report your enterprise customers will accept.
We review your IRAP contribution agreement to confirm which engagement components are eligible for reimbursement. If you don't have IRAP yet, we point you to the application process.
SOC 2 Trust Services Criteria gap assessment scoped to your actual stack. We structure deliverables to align with IRAP reporting requirements.
Fixed-scope implementation: policies, controls, GRC platform, evidence collection. Deliverables map to your IRAP project milestones.
We manage auditor communication and help document the engagement for IRAP reporting. Most engagements come back from audit with no findings.
Before we talk, see exactly where your SOC 2 program stands. Our free scorecard maps your current state across 6 control domains, gives you a maturity score out of 100, and emails a detailed report with prioritized next steps. No sales pitch, just an honest read.
Take the SOC 2 ScorecardWe help structure deliverables to meet NRC IRAP reporting requirements, so the reimbursement process is clean.
SOC 2 is not your only obligation. We design controls that cover Canadian privacy requirements at the same time.
IRAP funding can cover work that satisfies SOC 2, ISO 27001, and CPCSC simultaneously. We scope for maximum framework coverage.
Quebec companies and bilingual teams get policies and documentation in both languages.
IRAP contribution agreements typically cover consulting fees for the Build phase: gap assessment, policy design, control implementation, and GRC platform configuration. The audit itself (conducted by an independent firm) and the ongoing GRC platform subscription are usually separate costs. We structure the engagement so the highest-value consulting work falls within the IRAP-funded portion.
Ideally, yes. IRAP contribution agreements have defined project windows, and work completed before approval may not be eligible for reimbursement. If you are in the application process, we can help structure the SOC 2 engagement description for your IRAP submission.
IRAP contribution agreements vary by program stream and company size. Coverage typically ranges from 50% to 80% of eligible consulting costs. We can review your specific agreement and estimate the funded portion during the scoping call.
Yes. If your IRAP project description includes security and compliance, the Build phase can cover SOC 2, ISO 27001, CPCSC, or a combination. We scope for maximum framework coverage within the funded window.
We have a detailed guide on NRC IRAP funding eligibility and the application process. Many of our Canadian clients have successfully applied for IRAP to fund their compliance program.
The Build phase is typically 8 to 12 weeks. If you have an active IRAP window with a deadline, we can adjust the timeline to fit. Type I readiness is achievable within most IRAP project windows.
Tell us about your IRAP agreement and your timeline. We will respond within one business day with a fixed-price scoping call slot.
Fixed price. Senior consultants. IRAP-aligned deliverables. A clear path from funded project to SOC 2 report.
Book a Scoping Call