1. What SOC 2 examines
A SOC 2 examination is an attestation engagement performed by an independent CPA firm using the AICPA’s Trust Services Criteria. The report concerns the system and controls described by the service organization within a defined examination scope.
The criteria are grouped into five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The Security Common Criteria are foundational; the other categories depend on the relevant services and commitments.
SOC 2 is not a certification of the entire company. The report covers the specified system, criteria, and examination date or period.
Type I and Type II
| Aspect | Type I | Type II |
|---|---|---|
| Examination period | A specified date | A defined period |
| Focus | Suitability of control design as of that date | Control design and operating effectiveness throughout the period |
| Records | Documents and evidence relevant to the date | Evidence showing the controls operated during the defined period |
| Planning concern | Controls must be designed and implemented appropriately at the date | Activities and records need to cover the relevant operating period |
Buyers may ask for one type specifically. Clarify the actual request and discuss the report timing with a CPA firm before committing to an examination date.
2. What readiness involves
Readiness work identifies what the business does, which controls support the selected criteria, where gaps remain, and what records are available to demonstrate operation.
The work normally involves scope, control descriptions, policies, assigned owners, risk management, vendor oversight, evidence sources, issue tracking, and examination preparation. Technical remediation may also be necessary. A readiness review can identify shortcomings, but the CPA firm reaches its own conclusions in the examination.
3. When a business needs SOC 2
SOC 2 is often requested during enterprise procurement, renewals, or vendor due diligence. A customer may want evidence that a SaaS provider has an established security program and that relevant controls have been examined independently.
Before starting, identify the exact customer request, contractual commitments, desired report type, relevant categories, and business deadline. A deadline set by sales does not shorten the time needed to implement a control or demonstrate its operation during a Type II period.
4. Define the system boundary
The company must be able to describe what service is being examined and what systems and processes support it. For a cloud-hosted SaaS product, this may include the production environment, identity provider, development systems, support services, staff, contractors, and critical third parties.
Document what is included and excluded. Identify subservice organizations and responsibilities that remain with the company. Management should review the proposed boundary, and the CPA firm should be consulted early about examination expectations.
A narrow scope is not automatically good if it leaves out necessary components. A broad scope is not automatically good if it adds unrelated systems and work.
5. Select relevant Trust Services Criteria
Security forms the foundation of the examination. Other categories require consideration of the system and commitments:
- Availability: Commitments concerning service availability and recovery.
- Processing Integrity: Commitments to complete, accurate, timely, and authorized processing.
- Confidentiality: Commitments for information designated confidential.
- Privacy: Requirements for personal information covered by the Privacy criteria.
Selecting criteria creates obligations for control design and evidence. Management and the CPA firm should discuss the appropriate categories instead of selecting everything for appearances.
6. Review existing practices
Many companies already perform useful control activities. Inventory them before adding new ones.
Review how accounts are provisioned and removed, changes are approved and deployed, vendors are evaluated, vulnerabilities are handled, incidents are managed, backups are tested, risks are decided, and security policies are approved. Look for the actual procedure and the evidence it leaves behind.
Classify each activity as operating and evidenced, operating without reliable records, inconsistently performed, missing, or outside the proposed scope. Use the results to plan remediation rather than writing replacement documents for controls that already work.
7. Design appropriate controls
Each control should address a relevant risk or obligation, identify the responsible role, and describe the activity clearly enough to be performed and reviewed. State its scope, timing, decision points, evidence, and exception procedure.
For example, a cloud SaaS company generally relies on its cloud provider for certain physical controls while remaining responsible for its own configurations, access, and complementary controls. A template that assumes an in-house data center may not fit the actual environment.
Controls should be revised when systems or operations change. A growing list of control statements is not evidence that the program has improved.
8. Document policies and procedures
Policies establish management requirements. Procedures describe how employees and systems meet those requirements. Both should match actual operations and be reviewed by the people responsible before approval.
Common areas include access, change management, incident response, vendor risk, data handling, personnel security, business continuity, and risk management. Some can be combined or tailored depending on scope.
If a policy requires quarterly access reviews, the company needs a way to identify the population, conduct the review, record decisions, implement removals, and retain evidence. Do not set a frequency because a generic template says to; determine the appropriate requirement and confirm it can be performed.
9. Handle gaps and risk decisions
Every material gap needs an observation tied to evidence, an assigned owner, a decision or treatment plan, and a date for follow-up. Technical owners carry out changes. Management determines whether risk is accepted and what resources are authorized.
Keep severity, tolerance, and priority separate. A significant vulnerability, a contractual deadline, and an accepted exception can affect action order for different reasons. A single numerical score does not replace the reasoning or the decision record.
An issue should be marked resolved only after appropriate evidence supports closure. Changing a ticket status does not establish that the underlying control works.
10. Retain evidence
Identify the expected evidence when the control is designed. Access-review approvals, change tickets, identity-policy exports, vendor assessments, recovery tests, and incident-exercise records all require context to show which systems and periods they cover.
Check for the relevant population, date or period, reviewer, result, exceptions, and follow-up. A screenshot of a configuration may not establish that it applied throughout a Type II observation period.
Store records by control and period. Review them while the work is being done so that missing information can be corrected before the examination. The CPA firm determines final sufficiency.
11. Prepare for the CPA firm
Agree on the examination scope, criteria, intended reporting period, management responsibilities, and schedule with the selected CPA firm. Ensure that the system description reflects the actual service.
Organize the control inventory, approved policies, risk and exception decisions, vendor information, evidence index, and open issues. Give the CPA firm accurate records and respond to its requests; do not assume an internal checklist is a substitute for examination procedures.
GetComply or another advisor can coordinate preparation and records. The firm remains independent and management is responsible for its statements.
12. Maintain the program
After the report, the company still needs account reviews, vendor assessments, control changes, incident and recovery preparation, customer questionnaires, and policy updates.
Keep a calendar stating the activity, frequency, owner, expected record, and escalation route. Review the calendar and unresolved issues regularly. This also makes the following examination easier to plan because the relevant records already exist.
13. Check the starting position
This is an initial self-check, not a pass/fail assessment, audit prediction, or certification.
This checklist helps organize an initial discussion. Checking an item is a self-reported answer, not a determination that the company is audit-ready. Each item should be supported by a real record when appropriate.
0 of 19 items checked
Your answers stay in this browser tab's session storage until the tab session ends. They are sent only if you choose to carry them into the contact form, where you can edit or delete them before submitting.
14. Decide what outside help is needed
Software can collect and organize information. A readiness consultant can assess gaps or work on a defined project. An internal GRC employee can operate the program as part of the company. A managed provider can handle an agreed part of that recurring work. Legal counsel provides legal advice; a CPA firm conducts the independent examination.
Before selecting an approach, identify which tasks require ongoing attention, who can make decisions, and what internal technical capacity is available. Then scope the outside work accordingly.