Framework Scope Lock (Onboarding)

Framework Scope Lock (Onboarding)

1. 01

   Name the exact certification the client's buyer will ask for, not the certification the agency finds easiest to produce

   A mid-market prospect asking for SOC 2 Type II is not asking for ISO 27001, and the two carry different evidence windows and auditor expectations. Write the framework name, type, and reporting period into the engagement letter before any monitoring integration is connected.

2. 02

   Map every control in scope to a named owner inside the client's org

   Controls without a human owner become audit exceptions. Assign each control to a role (CTO, Head of People, IT lead) and record the assignment in the shared workspace so the client sees the same list the agency sees.

3. 03

   Inventory the systems that will feed evidence and confirm each one has an integration path

   Platforms such as Vanta and Drata monitor hundreds of connected services, but a self-hosted database or a legacy HR system may have no connector. Flag unmonitored systems on day one so the client budgets for manual evidence collection instead of discovering the gap two weeks before fieldwork.

4. 04

   Set the evidence retention window against the audit period, not the calendar year

   A SOC 2 Type II covering January through December needs evidence that survives the full observation window. Confirm log retention settings in the client's cloud provider before the period opens, because backfilling deleted logs is not possible.

5. 05

   Agree on the auditor relationship and who holds the engagement letter

   Some clients already have a CPA firm; others expect the agency to introduce one. Decide whether the agency coordinates the audit or stays in a support role, and put that boundary in writing so scope creep does not land on the retainer.

6. 06

   Document the exit path for the monitoring platform before the first invoice

   Export formats, control mappings, and historical evidence should be retrievable if the client moves to a different vendor such as Secureframe or Sprinto. Agencies that skip this step inherit framework lock-in and lose negotiating room at renewal.