soc2-compliance

SOC 2 Type 2 preparation requires implementing the 12 minimum policies, operating controls over a 6-12 month period, and collecting dated evidence such as access reviews, change tickets, and incident logs. A readiness checklist verifies governance, access controls, monitoring, and vendor management before engaging an auditor.

Type 1 is a point-in-time assessment confirming controls are suitably designed as of a specific date, typically taking 2-4 months. Type 2 evaluates whether controls operated effectively over a 6-12 month period and is required by most enterprise customers.

Security (Common Criteria CC1-CC9) is always required in every SOC 2 report. Availability, Processing Integrity, Confidentiality, and Privacy are optional and should be included based on SLA commitments, transaction processing, confidential data handling, or privacy obligations.

The AICPA publishes a mapping from Trust Services Criteria to NIST 800-53 families. For example, CC6 logical access maps to AC and IA, CC7 incident response maps to IR, and CC8 change management maps to CM and SA.

Common gaps include missing formal access reviews, developers deploying directly to production without separation of duties, untested incident response plans, uninvestigated monitoring alerts, uncollected vendor SOC reports, and backups never verified through restoration tests.