Free · 10 questions · About five minutes

Find out how ready you are for a SOC 2, SOX 404, or cybersecurity audit — before someone asks.

A readiness scorecard built by a licensed CPA firm with CISSP auditors on staff. Answer ten questions about your controls and get a score, a gap list, and a straight answer — no sales call required.

Get your readiness score See how scoring works

No account neededResults emailed as a PDFNo sales call required

Sample resultScored

out of 10SOC 2 Type 2 · Likely 3–5 months out

What an auditor would flag first

Logical accessGap

Evidence collectionGap

Vendor managementGap

Backups & continuityGap

1,000+completed engagements

CPA + CISSPlicensed accountants and security auditors under one roof

Book onlinepick a time Mon–Fri, Carl sends the Teams invite

$10M+mid-market companies in the US and Canada

Three reasons people land here

Pick the audit you’re being asked for. The scorecard adapts.

Each path asks different questions because each auditor looks for different evidence. You’ll be scored against the standard you’ll actually be examined on.

SOC 2 reporting

Enterprise procurement sent a 200-row security questionnaire and the deal is stalled on a report you don’t have yet.

Built forSaaS providers, banks, law firms, accounting firmsStart the SOC 2 scorecard

SOX 404 readiness

You’re newly public, recently de-SPAC’d, or preparing to list — and the first-year internal-control deadline is dated and non-negotiable.

Built forUS-listed and pre-IPO companiesStart the SOX 404 scorecard

Cybersecurity assessment

Too big to ignore security, too small for the largest firms to bother with. You want a peer-sized auditor who shows up.

Built forAny mid-market company, $10M+ revenueStart the cybersecurity scorecard

How scoring works

Value first. The call is optional and comes last.

Answer ten questions about your controls

Access reviews, vendor management, incident response, evidence collection. The questions are the ones an auditor asks in the first meeting — written with the people who run those meetings.

Get your score and gap list on the spot

A number out of ten, a realistic time-to-audit, and the specific controls that would be flagged first. Emailed to you as a PDF with a reference number you can keep.

If you want, talk it through with the auditor — 30 minutes, no pitch

Your report is emailed to you. If the gap list raises questions, book 30 minutes with Carl Grifka at Alpha Secure and he’ll go through it with you; if it doesn’t, ignore it. Either way, you keep the report.

Who’s behind the scorecard

An auditor, not a sales rep.

Alpha Secure LLP is a licensed CPA firm fused with a cybersecurity audit practice. It serves mid-market companies that the largest firms don’t prioritize — and that’s exactly who this scorecard is for.

SOC 1 · SOC 2 · SOC 3SOX 404Cybersecurity assessmentInternal audit

Carl GrifkaCISSP · CISA · CISM · PMP

Internal controls and SOC reporting specialist. Eighteen years in IT risk advisory, most of it at a top-five national accounting firm, before joining Alpha Secure as a principal. He wrote the scorecard questions.

Read the articles

From the practice

What the auditor wishes you knew before the kickoff.

All articles

CyberBusiness email compromise: the controls that stop the wireA wire leaves because a payment process allowed it, not because an email was clever. The controls that stop business email compromise, and what the SEC said public companies owe here.The Clean Opinion · 7 min read

SOX 404Co-sourced internal audit in a first SOX year: who owns whatA co-source provider can bring method and testing capacity to a first SOX year. The firm signing your audit report is generally not available to staff this work, and management's assessment stays with management.The Clean Opinion · 7 min read

SOC 2What a trust services criterion is, and what it is notCriteria and controls are not the same thing. Here is where the trust services criteria come from, what a single criterion is, and what the difference changes about how you scope a SOC 2.The Clean Opinion · 6 min read

Ten questions now beats a failed audit in nine months.

Free, takes five minutes, and you keep the report whether or not you ever talk to us.

Get your readiness score