The Clean OpinionGet your score
Free · 10 questions · About four minutes

Find out if you’d pass a SOC 2 audit before a customer asks.

A readiness scorecard built by a licensed CPA firm with CISSP auditors on staff. Answer ten questions about your controls and get a score, a gap list, and a straight answer — no sales call required.

Get your readiness scoreSee how scoring works
No account neededResults emailed as a PDFReviewed by a human auditor
Sample result
6
out of 10SOC 2 Type 2 · Likely 3–5 months out
What an auditor would flag first
Evidence collectionGap
Vendor managementGap
Logical accessIn place
Onboarding & offboardingIn place
1,000+completed engagements
CPA + CISSPlicensed accountants and security auditors under one roof
1 business dayguaranteed response on every engagement
Mid-market only$10M–$100M companies in the US and Canada
Three reasons people land here

Pick the audit you’re being asked for. The scorecard adapts.

Each path asks different questions because each auditor looks for different evidence. You’ll be scored against the standard you’ll actually be examined on.

SOC 1 / SOC 2 reporting

Enterprise procurement sent a 200-row security questionnaire and the deal is stalled on a report you don’t have yet.

Built forSaaS providers, banks, law firms, accounting firms

SOX 404 readiness

You’re newly public, recently de-SPAC’d, or preparing to list — and the first-year internal-control deadline is dated and non-negotiable.

Built forUS-listed and pre-IPO companies

Cybersecurity assessment

Too big to ignore security, too small for the largest firms to bother with. You want a peer-sized auditor who shows up.

Built forAny mid-market company, $10M–$200M
How scoring works

Value first. The sales call is optional and comes last.

01
Answer ten questions about your controls

Access reviews, vendor management, incident response, evidence collection. The questions are the ones an auditor asks in the first meeting — written by the people who run those meetings.

02
Get your score and gap list on the spot

A number out of ten, a realistic time-to-audit, and the specific controls that would be flagged first. Emailed to you as a PDF with a reference number you can keep.

03
If you want, talk it through with the auditor — 30 minutes, no pitch

Your results go to Carl Grifka at Alpha Secure, who reads every one. Book a call if the gap list raises questions; ignore it if it doesn’t. Either way, you keep the report.

Who reads your results

An auditor, not a sales rep.

Alpha Secure LLP is a licensed CPA firm fused with a cybersecurity audit practice. It serves mid-market companies that the largest firms don’t prioritize — and that’s exactly who this scorecard is for.

SOC 1 · SOC 2 · SOC 3SOX 404Cyber assessmentInternal audit
Carl Grifka
Carl GrifkaCISSP · CISA · CISM · PMP

Internal controls and SOC reporting specialist. Eighteen years in IT risk advisory, most of it at a top-five national accounting firm, before joining Alpha Secure as a principal. He wrote the questions you’re about to answer.

Read Carl’s articles
From the practice

What the auditor wishes you knew before the kickoff.

All articles
SOC 2SOC 2 Type 1 vs Type 2: which one actually unblocks the deal?Type 1 gets you into the conversation in weeks. Type 2 closes the larger accounts later. Most companies pick wrong because they start the week procurement asks.Carl Grifka · 7 min read
SOX 404Your first year as a public company: the SOX 404 timeline nobody hands youWhat has to exist by the first annual report, what the auditor will test, and where newly listed companies run out of time.Carl Grifka · 9 min read
Vendor reviewsHow to run an access review an auditor will acceptQuarterly access reviews are the single most common exception in first-year SOC 2 reports — and the easiest to fix properly.Carl Grifka · 6 min read

Ten questions now beats a failed audit in nine months.

Free, takes four minutes, and you keep the report whether or not you ever talk to us.

Get your readiness score