SOC 2 Readiness

Drive an organization from "no controls documented" to audit-ready.

1. Scoping

Determine report type: Type I (point-in-time) vs Type II (period of time — start the observation window early)
Define the system description: services in scope, infrastructure, boundaries (subprocessors, cloud providers)
Select Trust Services Criteria: Security (required) + Availability, Confidentiality, Processing Integrity, Privacy as applicable

2. Gap Assessment

Map current practices to the criteria:

| Area | Typical Criteria | Common Gaps | |---|---|---| | Access control | CC6.1–CC6.3 | No MFA, no role-based access, shared accounts | | Change management | CC8.1 | No peer review on deploys, no environment separation | | Risk assessment | CC3.1–CC3.4 | No annual risk assessment or vendor reviews | | Monitoring | CC7.1–CC7.3 | No log review, no alerting on anomalies | | Incident response | CC7.4–CC7.5 | No IR plan or tabletop evidence | | BC/DR | A1.2–A1.3 | Untested backups, no documented RTO/RPO | | Vendor management | CC9.2 | No subprocessor due diligence | | Onboarding/offboarding | CC6.1 | Access removal not timely or evidenced |

3. Remediation

Prioritize by audit-blocker status first, then risk
Implement policy + practice + evidence together: a policy without execution evidence fails
Typical timeline: 2–4 months for a Type I; Type II needs 2–12 months of operating evidence

4. Evidence Package

Per control: policy documents, implementation artifacts (screenshots, configs), and dated operating evidence over the review period (access reviews, change tickets, training logs, IR exercises)

5. Audit Logistics

Choose auditor; confirm scope wording matches your system description
Readiness assessment (optional but useful) → fieldwork → draft report review
Track findings/exceptions honestly; management responses documented

Output

Gap register with owners and dates, control matrix mapped to criteria, evidence repository structure, and auditor-ready system description.