performing-soc2-type2-audit-preparation

Start with a gap assessment against the AICPA Trust Services Criteria CC1-CC9 about 8-12 weeks before the audit period. Then automate evidence collection from cloud providers, identity systems, and version control, and validate that controls operated effectively across the entire period.

CC6 evidence includes MFA status reports for all IAM users, quarterly access review records, and offboarding tickets for terminated users. Collect these from AWS IAM credential reports, Okta policies, and ticketing systems like Jira.

Use Python with boto3 to query IAM for user MFA status, CloudTrail for logging configuration, and GuardDuty for findings. Schedule these checks daily via cron or Lambda to detect control drift throughout the audit period.

Type I evaluates control design at a single point in time, while Type II validates that controls operated effectively over a 3-12 month period. Type II requires sampling evidence across the full window, not just a final snapshot.

Failures typically come from controls that existed on paper but lapsed mid-period, such as MFA disabled temporarily or PRs merged without approval. Each lapse must be documented as an exception with remediation evidence rather than treated as a silent pass.

Security (Common Criteria CC1-CC9) is mandatory for every SOC 2 audit. Availability, Processing Integrity, Confidentiality, and Privacy are optional categories selected based on business relevance, but any claimed category must have actual controls and evidence.