Home › Cyber Security Services › Attestation & Audit Support
Cyber Security
SOC 1, SOC 2 & PCI DSS Attestation Services, Managed From Readiness to Report
Maven runs the entire attestation project under one contract: scoping, readiness, remediation, evidence, auditor procurement and the pass-through documentation that puts the finished report in your hands. The examination itself is performed by an independent licensed CPA firm, which issues your SOC 1 or SOC 2 report, or by a PCI SSC-listed Qualified Security Assessor, which completes your PCI DSS ROC and signs your AOC.
SOC 1 Type I · IISOC 2 Type I · IISOC 3PCI DSS ROC · AOCOne contract
What Is Attestation, and Who Is Allowed to Issue It?
Attestation is a formal written opinion from an independent, qualified third party that your controls meet a published standard. SOC 1 and SOC 2 reports can only be issued by a licensed CPA firm under AICPA attestation standards (SSAE 18). A PCI DSS Report on Compliance can only be completed by a PCI SSC-qualified QSA. Maven is neither; we procure the examination on your behalf, manage everything around it and pass the finished deliverables through to you with documented chain of title.
Who needs it
—SaaS, software and service companies selling into enterprise procurement
—Agencies, MSPs, healthcare vendors and data processors handling client data
—E-commerce and subscription businesses storing or transmitting card data
Pass-through model
One Contract. An Independent Opinion. Clear Title to the Report.
Maven sells attestation on a pass-through basis. You sign one agreement with Maven; Maven engages an independent licensed CPA firm or PCI SSC-listed QSA company to perform the examination, coordinates the fieldwork and passes the finished report, ROC or AOC through to you. The engagement letter, management assertion and opinion still run in your company's name, because the standards require it, and the auditor still determines its own scope, procedures, fees and conclusions.
What makes the pass-through safe is paperwork most firms skip. Every engagement ships with a chain of custody certification for the evidence we collect, an asset verification and transfer review before fieldwork, a pass-through title reconciliation when the deliverable arrives, and a chain of title declaration and bill of sale confirming the report is yours outright, with no rights retained by Maven.
Maven Marketing Group is a cyber security and growth consultancy. It is not a CPA firm and not a QSA company, never issues or co-signs an opinion, and never guarantees a clean report or a compliant AOC. Where Maven earns a referral or margin on a partner firm's fee, it is disclosed in writing before you sign.
Why Not Just Hire the CPA Firm Directly?
You can, and some companies should. Maven's value is the eighty percent of the work that happens before and around the audit: readiness, remediation, evidence, project management, procurement and the trust-center kit that turns the report into closed deals. Keeping the opinion with an independent firm is exactly what enterprise buyers and the AICPA expect.
Reports we take you to
SOC 1, SOC 2 and PCI DSS: Which One Your Customer Is Actually Asking For
Each report answers a different buyer. Send us the questionnaire or contract clause and we'll confirm which one, and which type, before anything is scoped.
SOC 1 Reports (Type I and Type II)
For service organizations whose services affect customers' internal control over financial reporting: payroll, billing, claims processing, fund administration, SaaS that feeds a general ledger. Issued under SSAE 18 / AT-C 320 and restricted to your customers and their auditors.
Type I — design and implementation at a point in time; the fastest first report
Type II — design plus operating effectiveness over 6–12 months; what customers' auditors want for SOX reliance
Who needs it — if your customers' financial auditors ask about your controls; many companies need SOC 1 and SOC 2 together
SOC 2 Reports (Type I and Type II) Most Asked
Controls relevant to the AICPA Trust Services Criteria, issued under SSAE 18 / AT-C 105 and 205 and shared under NDA. The most common enterprise ask for SaaS, MSPs, agencies and data processors. Security is required; Availability, Processing Integrity, Confidentiality and Privacy are scoped from your customer commitments during readiness.
Type I — point in time; weeks once you're ready; unblocks a deal while the Type II window runs
Type II — a 3-to-12-month observation period, six or more typical; renewed annually
SOC 3 — a public, general-use summary of a SOC 2 Type II, available through the same CPA partner
PCI DSS Attestation: ROC and AOC
PCI DSS v4.0.1 applies to anyone storing, processing or transmitting cardholder data. Level 1 merchants and service providers need a QSA-led Report on Compliance; lower levels validate with a Self-Assessment Questionnaire. Both produce an Attestation of Compliance. Segmentation and penetration testing cover Requirement 11.
ROC — the full assessment against all twelve requirements, completed only by a QSA or trained internal ISA; usually kept internal
AOC — the PCI SSC form summarizing result, scope and validation path; signed by your officer and the QSA; meant to be shared
SAQ — we select and complete the right SAQ with you; our QSA partner validates it when a customer requires an assessor-signed AOC
How it works
How Attestation Works With Maven
Most delays happen before fieldwork, not during it. We own the preparation, the procurement and the project management; the auditor owns the opinion.
01
Scoping Call
Which report, who is asking, target date, systems in scope and which Trust Services Criteria or PCI validation path apply.
02
Readiness and Gap Assessment
Current controls versus the standard, scored and owned. Delivered through our compliance readiness services.
03
Remediation Sprint
Policies written, controls implemented, evidence made reproducible. Technical fixes applied by Maven on systems it manages under website maintenance.
04
Asset Verification and Transfer Review
Before fieldwork we inventory every in-scope system, account and data flow, confirm ownership, and document what will be transferred to the auditor and returned to you. This is the baseline the chain of custody certification is measured against.
05
Auditor Procurement and Fieldwork Coordination
Maven engages a pre-vetted independent CPA firm or QSA company under the pass-through agreement, runs the evidence request list, prepares populations and samples, schedules interviews and keeps the auditor unblocked. Evidence moves under a logged chain of custody.
06
Report Issuance and Title Reconciliation
The CPA firm issues your SOC 1 or SOC 2 report; the QSA completes the ROC and co-signs the AOC. Maven reconciles the deliverable against the scope you bought, then executes the chain of title declaration and bill of sale so the report is unambiguously yours.
07
Trust-Center Kit, Bridge Letters and Renewal
We build the kit sales can use immediately, draft management's bridge letters between periods, and plan the renewal so year two costs less than year one.
Pass-through documentation
The Four Documents That Make a Pass-Through Sale Clean
—Chain of custody certification — Maven's signed record of every evidence item collected, who handled it, when it moved to the auditor and when it was returned or destroyed.
—Asset verification & transfer review — the pre-fieldwork inventory of in-scope systems, accounts and data flows, with ownership confirmed and transfer terms documented.
—Pass-through title reconciliation — a line-by-line match of the issued report, ROC or AOC against the scope, period and entity name you contracted for.
—Chain of title declaration & bill of sale — Maven's written transfer of the attestation deliverables to your company, free of any retained rights, with the independent firm's engagement letter attached.
These documents cover Maven's pass-through role. They are not part of the auditor's opinion and do not change the independent firm's scope, procedures or conclusions.
What you receive, and from whom
Deliverables and Typical Timelines
From Maven — readiness report and roadmap, policy set, control matrix, evidence repository, the four pass-through documents, trust-center and sales-enablement kit, bridge-letter support, annual renewal plan
From the independent CPA firm — SOC 1 or SOC 2 Type I or Type II report with its opinion; SOC 3 on request
From the PCI SSC-listed QSA — Report on Compliance and QSA-signed Attestation of Compliance, or validation of your SAQ
From you — management's assertion, signatures on the AOC and on bridge letters
SOC 2 Type I — 4–12 WKS readiness · 2–6 WKS examination · issued shortly after fieldwork
SOC 2 Type II — 4–12 WKS readiness · 3–12 MO observation · issued 30–60 days after period end
SOC 1 Type I / II — 4–12 WKS readiness · point in time / 6–12 MO
PCI DSS ROC + AOC — readiness varies with CDE scope · WEEKS–MONTHS assessment · annual
PCI DSS SAQ + AOC — 2–8 WKS · self-assessment, optional QSA validation · annual
Ranges are typical. The independent auditor or QSA sets the examination timeline.
Why Maven
One Team From the First Questionnaire to the Signed Report
Readiness, Remediation and Audit PM From One Team
The same people who run your website and infrastructure fix the findings and feed the evidence, so nothing waits on a third vendor.
Pre-Vetted CPA and QSA Partners, One Invoice
Independent firms that work with growing companies, procured under Maven's pass-through agreement with the partner's fee itemized separately on every quote. Fixed-scope readiness pricing on our side.
Chicago-Area, Built for Year Two
Lake Zurich and Deerfield offices with on-site workshops across Chicagoland. Evidence automation we set up in year one makes every renewal cheaper. Pair with annual penetration testing for Requirement 11 and SOC 2 evidence.
Proof
DeWalt Pressure Washers: Project Discipline That Compounds
A national equipment brand with dealer, retailer and procurement audiences. Maven's growth program produced a 412% increase in organic traffic, 3.4× more dealer-locator sessions and a 57% lower cost per lead over fourteen months, run with the same scoped, evidence-backed project management we apply to every attestation engagement. Read the DeWalt case study →
Engagement model
How It's Scoped and Priced
Maven's readiness, coordination and pass-through work is quoted as a fixed fee per phase, based on the report type, criteria in scope and company size. The independent CPA firm's or QSA's fee is quoted by that firm and passed through at cost plus a disclosed margin, itemized on its own line; published market ranges run from roughly $7,500 for a small Type I to well over $50,000 for a complex Type II.
FAQ
SOC and PCI Attestation Questions
Who can issue a SOC report?
Only a licensed CPA firm working under AICPA attestation standards (SSAE 18). Maven is not a CPA firm; reports for Maven clients are issued by an independent licensed CPA firm that Maven engages on your behalf under a pass-through agreement, with the engagement letter and opinion in your company's name.
What does pass-through attestation mean?
You contract with Maven once. Maven procures the examination from an independent CPA firm or QSA company, manages readiness and fieldwork, and transfers the finished report to you with a chain of custody certification, asset verification and transfer review, title reconciliation and a chain of title declaration and bill of sale. The auditor's independence, scope and conclusions are unchanged.
What is the difference between SOC 1 and SOC 2?
SOC 1 covers controls affecting your customers' financial reporting and is used by their financial auditors. SOC 2 covers security, availability, processing integrity, confidentiality and privacy and is used by security and vendor-risk teams. Many companies need both.
Type I vs. Type II: what's the difference?
A Type I report says controls were suitably designed and in place at a point in time. A Type II also tests that they operated effectively over a three-to-twelve-month period. Enterprise customers generally expect a Type II.
What is the difference between a PCI AOC and a ROC, and who signs?
The ROC is the full assessment against every PCI DSS requirement, completed by a PCI SSC-qualified QSA or trained internal ISA. The AOC is the one-form attestation you share with acquirers and customers, signed by an authorized officer of your company and by the QSA when a QSA assessed.
How long is a SOC 2 report or AOC valid, and what is a bridge letter?
SOC reports have no formal expiration, but most customers reject reports whose period ended more than twelve months ago, so renew annually; PCI validation is annual. A bridge letter is a statement from your own management covering the gap between the last report period and today.
Related services
Compliance Readiness
Where every attestation starts: gap assessment, policies, controls and evidence for SOC, HIPAA, ISO, PCI and NIST CSF.
Penetration Testing
Pen test evidence for SOC 2 and PCI DSS Requirement 11, with a letter of attestation you can hand to the auditor.
Website Management & Maintenance
Monitoring, patching, backups and hosting that double as operating evidence during your Type II period.
Ready to Stop Losing Deals in Security Review?
Tell us which report you've been asked for, who is asking and your target date. We'll map the path from today to a signed report, with Maven's fixed-fee readiness and the independent auditor's quote side by side.
Maven Marketing Group LLC is a cyber security and digital growth consultancy and is not a licensed CPA firm or a PCI SSC Qualified Security Assessor company. SOC 1, SOC 2 and SOC 3 examinations are performed, and reports issued, by an independent licensed CPA firm; PCI DSS Reports on Compliance and QSA-signed Attestations of Compliance are completed by an independent PCI SSC-listed QSA company. Maven procures these services on a pass-through basis and documents the transfer; the auditor or QSA determines its own scope, procedures, fees and conclusions.
