Mattakushi432 SOC 2 Preparation Guide
Disclaimer: This is informational only and does not constitute legal or audit advice. Engage a licensed CPA firm for your SOC 2 examination.
SOC 2 Overview
SOC 2 (Service Organization Control 2) is an auditing framework developed by AICPA. It evaluates controls at a service organization relevant to security, availability, processing integrity, confidentiality, and privacy of customer data.
Type I vs Type II
| Type I | Type II | |
|---|---|---|
| What it covers | Controls are suitably designed at a point in time | Controls are suitably designed AND operating effectively over a period |
| Time period | Single date | Minimum 6 months (typically 12) |
| Value | Quick win, less expensive | Higher assurance, preferred by enterprise buyers |
| Use case | First audit, new program | Recurring annual audit |
Recommendation: Pursue Type II for enterprise sales. Type I is a stepping stone.
Trust Service Criteria (TSC)
Only Security (Common Criteria) is mandatory. Others are optional add-ons.
CC: Security (Common Criteria) — Required
Nine categories (CC1–CC9):
| Category | Focus |
|---|---|
| CC1 | Control environment (tone at top, governance, accountability) |
| CC2 | Communication and information |
| CC3 | Risk assessment |
| CC4 | Monitoring activities |
| CC5 | Control activities |
| CC6 | Logical and physical access controls |
| CC7 | System operations |
| CC8 | Change management |
| CC9 | Risk mitigation (vendor management, business continuity) |
A: Availability (Optional)
- System availability for operation and use as agreed
- Performance monitoring, DR/BCP, capacity planning
PI: Processing Integrity (Optional)
- System processes are complete, valid, accurate, timely, authorized
- Critical for financial or transaction-processing systems
C: Confidentiality (Optional)
- Information designated confidential is protected as agreed
- Encryption, access controls, destruction procedures
P: Privacy (Optional)
- Personal information is collected, used, retained, disclosed per privacy notice
- Aligns with AICPA Privacy Management Framework (similar to GDPR principles)
Pre-Audit Readiness Assessment
Phase 1: Scoping (Months -12 to -9)
- Define system description boundaries (what is in scope)
- Identify all components: infrastructure, software, people, data, procedures
- Choose TSC categories based on customer requirements
- Select audit firm (Big 4, regional CPA, SOC specialist)
- Perform gap assessment against TSC criteria
Phase 2: Remediation (Months -9 to -3)
Fix gaps identified in assessment. Common gaps:
Access Control
- Centralized identity provider (Okta, Azure AD, Google Workspace)
- MFA enforced for all accounts (especially admin and remote access)
- Quarterly access reviews for all systems
- Privileged access management (PAM) for admin accounts
- Onboarding/offboarding procedures documented and enforced
- Principle of least privilege enforced
Security Monitoring
- SIEM or centralized log management
- Log retention minimum 12 months
- Intrusion detection/prevention (IDS/IPS)
- Vulnerability scanning (at least monthly)
- Penetration test (annual minimum)
- Incident response plan documented and tested
Change Management
- Change control policy documented
- Code review required before merge
- Separate environments (dev/staging/prod)
- Deployment approval workflow
- Emergency change procedure
Risk Management
- Formal risk assessment conducted annually
- Risk register maintained
- Risk treatment decisions documented
Business Continuity
- BCP and DRP documented
- Annual DR test with results documented
- RTO/RPO defined and tested
- Backup procedures tested and documented
Vendor Management
- Vendor inventory maintained
- Security assessments for critical vendors
- Contracts include security/confidentiality requirements
- Annual vendor review process
HR Security
- Background checks for employees with access to customer data
- Security awareness training (annual minimum, tracked)
- Acceptable use policy signed
- Confidentiality agreements signed
Phase 3: Evidence Collection (Months -3 to 0)
Auditors will request evidence for every control. Organize by TSC category.
Evidence Types
- Policies: Written, approved, dated, version-controlled documents
- Procedures: Step-by-step operational documentation
- Logs/Reports: System-generated evidence (access logs, scan reports)
- Screenshots: Configuration screenshots with timestamps
- Tickets: Change tickets, incident tickets showing process followed
Evidence Collection Tools
- Google Drive / SharePoint folder per control
- Vanta, Drata, Secureframe, Tugboat Logic (automated evidence collection platforms)
- Notion/Confluence for policy documentation
Common Evidence Requests
| Control | Evidence |
|---|---|
| MFA enforcement | IdP configuration screenshot, policy document |
| Access reviews | Completed review spreadsheets with approvals |
| Vulnerability scanning | Scan reports for period (monthly) |
| Pen test | Report + remediation evidence |
| Security training | Completion certificates, LMS report |
| Incident response | IR policy + any incident tickets from period |
| Change management | Sample change tickets with approvals |
| Background checks | Vendor confirmation (not actual reports) |
| Encryption | Configuration evidence (TLS settings, disk encryption) |
| Backups | Backup policy + test restoration evidence |
System Description
The auditor will publish a system description. Prepare this internally first:
Section 1: Overview of the system
Section 2: Components of the system
a. Infrastructure
b. Software
c. People
d. Procedures
e. Data
Section 3: Boundaries of the system
Section 4: How the system captures and addresses risks
Section 5: Description of subservice organizations (vendors in scope)
Section 6: Complementary user entity controls (CUECs) — what customers must do
Subservice Organizations
Any vendor that performs functions included in your scope must be addressed:
- Carve-out method: Exclude from scope, describe CUECs
- Inclusive method: Include in scope (requires their SOC 2 or direct assessment)
Common subservice orgs: AWS/GCP/Azure (infrastructure), Stripe (payments), Twilio (communications).
Common Control Framework Mapping
Map your controls to multiple frameworks to reduce duplicate work:
| Your Control | SOC 2 CC | ISO 27001 Annex A | NIST CSF |
|---|---|---|---|
| MFA | CC6.1 | A.9.4.2 | PR.AC-7 |
| Access review | CC6.2 | A.9.2.5 | PR.AC-1 |
| Vuln scanning | CC7.1 | A.12.6.1 | DE.CM-8 |
| Pen test | CC7.1 | A.18.2.3 | DE.CM-8 |
| Incident response | CC7.3 | A.16.1.5 | RS.RP-1 |
Audit Timeline
Month -12: Scoping, select auditor, gap assessment
Month -9: Remediation begins
Month -6: Observation period starts (Type II)
Month -3: Evidence collection
Month -1: Fieldwork / auditor interviews
Month 0: Draft report review
Month +1: Final report issued
Post-Audit Maintenance
- Annual Type II renewal
- Continuous monitoring via compliance automation platform
- Quarterly access reviews (don't slip to annual)
- Monthly vulnerability scans
- Annual pen test
- Annual security training completion tracking
- Vendor review annual cycle
- Policy review annual cycle (document reviews in policy headers)
Sharing the Report
- SOC 2 reports are confidential — share under NDA
- Prospects/customers request via security questionnaire process
- Some publish a "security page" confirming SOC 2 Type II status without sharing full report
- Trust portals (Vanta Trust, Drata Trust) allow controlled sharing