Soc2 prep

SOC 2 Preparation Guide

Disclaimer: This is informational only and does not constitute legal or audit advice. Engage a licensed CPA firm for your SOC 2 examination.

SOC 2 Overview

SOC 2 (Service Organization Control 2) is an auditing framework developed by AICPA. It evaluates controls at a service organization relevant to security, availability, processing integrity, confidentiality, and privacy of customer data.

Type I vs Type II

	Type I	Type II
What it covers	Controls are suitably designed at a point in time	Controls are suitably designed AND operating effectively over a period
Time period	Single date	Minimum 6 months (typically 12)
Value	Quick win, less expensive	Higher assurance, preferred by enterprise buyers
Use case	First audit, new program	Recurring annual audit

Recommendation: Pursue Type II for enterprise sales. Type I is a stepping stone.

Trust Service Criteria (TSC)

Only Security (Common Criteria) is mandatory. Others are optional add-ons.

CC: Security (Common Criteria) — Required

Nine categories (CC1–CC9):

Category	Focus
CC1	Control environment (tone at top, governance, accountability)
CC2	Communication and information
CC3	Risk assessment
CC4	Monitoring activities
CC5	Control activities
CC6	Logical and physical access controls
CC7	System operations
CC8	Change management
CC9	Risk mitigation (vendor management, business continuity)

A: Availability (Optional)

• System availability for operation and use as agreed
• Performance monitoring, DR/BCP, capacity planning

PI: Processing Integrity (Optional)

• System processes are complete, valid, accurate, timely, authorized
• Critical for financial or transaction-processing systems

C: Confidentiality (Optional)

• Information designated confidential is protected as agreed
• Encryption, access controls, destruction procedures

P: Privacy (Optional)

• Personal information is collected, used, retained, disclosed per privacy notice
• Aligns with AICPA Privacy Management Framework (similar to GDPR principles)

Pre-Audit Readiness Assessment

Phase 1: Scoping (Months -12 to -9)

• Define system description boundaries (what is in scope)
• Identify all components: infrastructure, software, people, data, procedures
• Choose TSC categories based on customer requirements
• Select audit firm (Big 4, regional CPA, SOC specialist)
• Perform gap assessment against TSC criteria

Phase 2: Remediation (Months -9 to -3)

Fix gaps identified in assessment. Common gaps:

Access Control

• Centralized identity provider (Okta, Azure AD, Google Workspace)
• MFA enforced for all accounts (especially admin and remote access)
• Quarterly access reviews for all systems
• Privileged access management (PAM) for admin accounts
• Onboarding/offboarding procedures documented and enforced
• Principle of least privilege enforced

Security Monitoring

• SIEM or centralized log management
• Log retention minimum 12 months
• Intrusion detection/prevention (IDS/IPS)
• Vulnerability scanning (at least monthly)
• Penetration test (annual minimum)
• Incident response plan documented and tested

Change Management

• Change control policy documented
• Code review required before merge
• Separate environments (dev/staging/prod)
• Deployment approval workflow
• Emergency change procedure

Risk Management

• Formal risk assessment conducted annually
• Risk register maintained
• Risk treatment decisions documented

Business Continuity

• BCP and DRP documented
• Annual DR test with results documented
• RTO/RPO defined and tested
• Backup procedures tested and documented

Vendor Management

• Vendor inventory maintained
• Security assessments for critical vendors
• Contracts include security/confidentiality requirements
• Annual vendor review process

HR Security

• Background checks for employees with access to customer data
• Security awareness training (annual minimum, tracked)
• Acceptable use policy signed
• Confidentiality agreements signed

Phase 3: Evidence Collection (Months -3 to 0)

Auditors will request evidence for every control. Organize by TSC category.

Evidence Types

• Policies: Written, approved, dated, version-controlled documents
• Procedures: Step-by-step operational documentation
• Logs/Reports: System-generated evidence (access logs, scan reports)
• Screenshots: Configuration screenshots with timestamps
• Tickets: Change tickets, incident tickets showing process followed

Evidence Collection Tools

• Google Drive / SharePoint folder per control
• Vanta, Drata, Secureframe, Tugboat Logic (automated evidence collection platforms)
• Notion/Confluence for policy documentation

Common Evidence Requests

Control	Evidence
MFA enforcement	IdP configuration screenshot, policy document
Access reviews	Completed review spreadsheets with approvals
Vulnerability scanning	Scan reports for period (monthly)
Pen test	Report + remediation evidence
Security training	Completion certificates, LMS report
Incident response	IR policy + any incident tickets from period
Change management	Sample change tickets with approvals
Background checks	Vendor confirmation (not actual reports)
Encryption	Configuration evidence (TLS settings, disk encryption)
Backups	Backup policy + test restoration evidence

System Description

The auditor will publish a system description. Prepare this internally first:

Section 1: Overview of the system
Section 2: Components of the system
  a. Infrastructure
  b. Software
  c. People
  d. Procedures
  e. Data
Section 3: Boundaries of the system
Section 4: How the system captures and addresses risks
Section 5: Description of subservice organizations (vendors in scope)
Section 6: Complementary user entity controls (CUECs) — what customers must do

Subservice Organizations

Any vendor that performs functions included in your scope must be addressed:

• Carve-out method: Exclude from scope, describe CUECs
• Inclusive method: Include in scope (requires their SOC 2 or direct assessment)

Common subservice orgs: AWS/GCP/Azure (infrastructure), Stripe (payments), Twilio (communications).

Common Control Framework Mapping

Map your controls to multiple frameworks to reduce duplicate work:

Your Control	SOC 2 CC	ISO 27001 Annex A	NIST CSF
MFA	CC6.1	A.9.4.2	PR.AC-7
Access review	CC6.2	A.9.2.5	PR.AC-1
Vuln scanning	CC7.1	A.12.6.1	DE.CM-8
Pen test	CC7.1	A.18.2.3	DE.CM-8
Incident response	CC7.3	A.16.1.5	RS.RP-1

Audit Timeline

Month -12:  Scoping, select auditor, gap assessment
Month -9:   Remediation begins
Month -6:   Observation period starts (Type II)
Month -3:   Evidence collection
Month -1:   Fieldwork / auditor interviews
Month 0:    Draft report review
Month +1:   Final report issued

Post-Audit Maintenance

• Annual Type II renewal
• Continuous monitoring via compliance automation platform
• Quarterly access reviews (don't slip to annual)
• Monthly vulnerability scans
• Annual pen test
• Annual security training completion tracking
• Vendor review annual cycle
• Policy review annual cycle (document reviews in policy headers)

Sharing the Report

• SOC 2 reports are confidential — share under NDA
• Prospects/customers request via security questionnaire process
• Some publish a "security page" confirming SOC 2 Type II status without sharing full report
• Trust portals (Vanta Trust, Drata Trust) allow controlled sharing