BD Emerson published a guide breaking down the trade-offs, costs, responsibilities, and decision points in SOC models.

BD Emerson is a consulting firm working across technology, cybersecurity, compliance, privacy, and M&A advisory. We set strategy, build and secure systems, keep organizations audit-ready, and carry transactions from due diligence through post-merger integration. Technology: digital transformation, data engineering, and enterprise AI on platforms including Databricks and Palantir Foundry, with AI governance built in. Cybersecurity: security programs, penetration testing, incident response, and virtual CISO leadership. Compliance and assurance: SOC 2 examinations performed by our CPA attest arm, plus readiness and internal audit for ISO 27001, ISO 42001, HIPAA, GDPR, CMMC, and FedRAMP. Privacy: privacy programs, DPO as a service, and data protection built into products and operations. M&A and transaction advisory: buy-side and sell-side due diligence across financial, quality of earnings, commercial, operational, technology, and cyber workstreams, carve-outs and divestitures, TSA advisory, post-merger integration, and private equity value creation. Findings get priced into decisions, and the team that advises is the team that delivers. Senior practitioners, 15+ years in practice, headquartered in Richmond, Virginia.