Auditor timelines

When should you book your SOC 2 audit?

Use published firm timelines as a starting point, then obtain dated commitments for fieldwork, review and report delivery.

172firm timeline records currently publishedUpdated from sourced auditor profiles
Q1Plan early

Year-end reporting and new compliance budgets can compress reviewer availability. Confirm the engagement team and evidence dates before January.

Q2Good planning window

A practical window for first-audit scoping and readiness work when a year-end report is not required.

Q3Book year-end work

Secure fieldwork and review dates now if customers or renewals require a report before year end.

Q4Capacity can tighten

Do not rely on a verbal delivery estimate. Put evidence, fieldwork, exception review and report dates in the engagement letter.

Firm-level records

Published audit timelines

These are profile records, not live capacity promises. Ask each firm to confirm dates for your scope.

FirmPublished timelineAudit typesCompany fitRecord freshness
360 Advanced3–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
A-LIGN3–12 wkConfirm in proposalType I · Type II50–5000+ employees2026-10-12
AAFCPAs6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
AARC-3604–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Accedere4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Accorp Partners13–26 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Advantage Partners6–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Anders CPAs + Advisors8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Aprio4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Assurance Dimensions8–16 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
AssurancePoint3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
ATA (Alexander Thompson Arnold)6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Audit Advantage Group4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Audit Peak3–9 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Auditwerx3–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Baker Tilly4–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Barnes Dennig3–9 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
BARR Advisory8–16 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
BD Emerson6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
BDO Australia5–13 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
BDO Canada5–13 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
BDO UK6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
BDO USA5–13 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Bennett Thrasher8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
BerryDunn6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Boulay Group3–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
BPM6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Carr, Riggs & Ingram (CRI)4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
CAS Assurance4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
CBIZ4–9 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
CertPro6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
CertPro Germany3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
CertValue Germany3–9 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Cherry Bekaert6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Chiaro3–4 wkConfirm in proposalType I · Type IIUnder 50 employees2026-10-12
Citrin Cooperman6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
CLA (CliftonLarsonAllen)6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Clark Nuber6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Coalfire4–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
CohnReznick4–11 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
CompliancePoint Assurance6–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Consilium Labs2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Constellation GRC4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
ControlCase4–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Copeland Buhl4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Councilor, Buchanan & Mitchell (CBM)4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Crowe Global5–13 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Crowe LLP4–9 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Crowe MacKay LLP4–11 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
CyberCrest4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
CyberGuard Advantage4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
CyberSapiens Australia3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
CyberSapiens Germany3–7 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Dannible McKee8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Dansa D'Arata Soucia LLP3–9 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Decrypt Compliance4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Deloitte6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
Deloitte Australia6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Deloitte Canada6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Deloitte Germany6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
Deloitte India8–16 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
Design Assurance4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Doeren Mayhew6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Drummond Group4–16 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
eDelta Consulting6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Eide Bailly6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
EisnerAmper6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Elliott Davis6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
EY Australia6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
EY Canada6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
EY Germany6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
FinAudit CPA6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Fine Assurance4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Fortreum4–18 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Forvis Mazars5–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Forvis Mazars UK10–24 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Frank, Rimerman + Co.4–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Frazier & Deeter4–14 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Geels Norton2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Grant Thornton5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Grant Thornton Australia5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Grant Thornton Canada5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Grant Thornton UK5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Grassi6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
GRF CPAs & Advisors6–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Herbein + Company6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
HLB Mann Judd4–11 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
HoganTaylor8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Holbrook & Manter4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Insight Assurance3–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
IS Partners8–16 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Kaufman Rossin8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Keiter6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Ken & Co4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
KirkpatrickPrice3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
KLR (Kahn Litwin Renza)6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
KPMG6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
KPMG Australia6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
KPMG Canada6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
KPMG Germany6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
KSM (Katz, Sapper & Miller)6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Larson & Company4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Lazarus Alliance4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
LBMC26–52 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Linford & Company3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Manning Elliott LLP4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Mauldin & Jenkins6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Mazars Germany5–13 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
McKonly & Asbury8–16 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
MGO (Macias Gini O'Connell)8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
MHM Professional Corporation2–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
MNP LLP4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Modern Assurance1–7 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Moore Colson6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
NDB6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-09-27
NDB CPA6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
NDNB Accountants6–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Oread Risk & Advisory3–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
PBMares4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Pease Bell CPAs4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
PKF O'Connor Davies6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Plante Moran6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Prager Metis6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Prescient AssuranceQuote requiredConfirm in proposalType I · Type II10–500 employees2026-09-30
Prescient Security2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
PwC6–20 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
PwC Australia6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
PwC Canada6–18 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
PwC Germany6–18 wkConfirm in proposalType I · Type II500–1,000 employees · 1,000+ employees2026-10-12
PYA26–52 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Rehmann6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Render Compliance4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Richey May Advisory4–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
RS Assurance & Advisory4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
RSM Australia5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
RSM Canada5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
RSM Ebner Stolz5–13 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
RSM US5–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
RubinBrown6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Sage Audits5–7 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Saltmarsh, Cleaveland & Gund6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
SAV Associates3–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
SC&H Group6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Schellman3–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Schneider Downs4–11 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Securance4–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Securisea4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
SensibaQuote requiredConfirm in proposalType I · Type II20–1000+ employees2026-09-30
Sensiba LLP4–10 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Sentry Assurance2–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
Sikich10–24 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
SingerLewak6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Smith + Howard6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Sustainable Certification12–52 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Tanner LLC4–8 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Tempo Audits2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12
The Pun Group6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Thomas Howell Ferguson8–20 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Thoropass2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Throughline4–12 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
TrustNet6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
UHY10–24 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
VISTA InfoSec6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Warren Averett6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Weaver6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Windes6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Windham Brannon4–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Wipfli6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
Withum4–11 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees · 500–1,000 employees2026-10-12
Wolf & Company6–14 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees · 1,000+ employees2026-10-12
YHB CPAs & Consultants6–12 wkConfirm in proposalType I · Type II50–500 employees · 500–1,000 employees2026-10-12
Zero Day CPA2–6 wkConfirm in proposalType I · Type IIUnder 50 employees · 50–500 employees2026-10-12

How to read this: a published duration is not the same as current availability. Your contract should separate readiness, observation period, fieldwork, management responses, quality review and final issuance.

Ask for the full schedule

Get separate dates for readiness, the observation period, fieldwork, management review and final delivery. This makes quotes much easier to compare.

Booking for Q4 or Q1?

Ask who will be assigned, when evidence is due, how quickly exceptions will be reviewed and whether quality review capacity is already reserved.

Need firms that fit your deadline?

Share your target report date and company scope. We’ll build a focused shortlist.

Get matched →
SOC 1✦SOC 2✦SOC 3✦Type I✦Type II✦Audit readiness✦Trust centers✦Vendor risk✦Security evidence✦Procurement✦