soc2-compliance

---
name: soc2-compliance
description: Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess Type I vs Type II readiness.
category: Regulatory & Quality
version: 1.0.0
tools: []
---

# SOC 2 Compliance

SOC 2 Type I and Type II compliance preparation for SaaS companies: Trust Service Criteria mapping, control matrix design, evidence collection, gap analysis, and audit readiness assessment.

## Overview

SOC 2 (System and Organization Controls 2) is an AICPA auditing framework evaluating how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.

### Type I vs. Type II

| Aspect | Type I | Type II |
|--------|--------|---------|
| Scope | Design of controls at a point in time | Design AND operating effectiveness over a period |
| Duration | Snapshot (single date) | Observation window (3-12 months, typically 6) |
| Evidence | Control descriptions, policies | Descriptions + operating evidence (logs, tickets, screenshots) |
| Cost | $20K-$50K audit fees | $30K-$100K+ audit fees |
| Timeline | 1-2 months (audit phase) | 6-12 months (observation + audit) |
| Best For | First-time compliance, rapid market need | Mature organizations, enterprise customers |

Who needs SOC 2: SaaS companies selling to enterprise customers, cloud infrastructure providers, data processors handling PII/PHI/financial data, managed service providers with client-system access, and any vendor whose customers require third-party assurance.

Typical journey: Gap Assessment (4-8 wk) → Remediation (8-16 wk) → Type I Audit (4-6 wk) → Observation Period (6-12 mo) → Type II Audit (4-6 wk) → Annual Renewal (ongoing).

## Trust Service Criteria

SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every report; the other four are optional, selected by business need.

### Security (Common Criteria CC1-CC9) — Required

Maps to COSO 2013 principles. CC1 Control Environment (integrity/ethics, board oversight, org structure, competence, accountability); CC2 Communication & Information; CC3 Risk Assessment (risk identification, fraud risk, change impact analysis); CC4 Monitoring Activities (ongoing monitoring, deficiency evaluation, corrective actions); CC5 Control Activities (policies/procedures, technology controls); CC6 Logical & Physical Access (provisioning, authentication, encryption, physical restrictions); CC7 System Operations (vulnerability management, anomaly detection, incident response); CC8 Change Management (authorization, testing, approval, emergency changes); CC9 Risk Mitigation (vendor/business partner risk management).

### Optional categories

**Availability (A1)** — A1.1 capacity management, A1.2 recovery operations (backup, DR, BCP testing), A1.3 recovery testing (DR drills, failover, RTO/RPO validation). Select when customers depend on uptime, you have SLAs, or downtime causes direct business impact.

**Confidentiality (C1)** — C1.1 identification (data classification, confidential data inventory), C1.2 protection (encryption at rest/in transit, DLP, access restrictions), C1.3 disposal (secure deletion, media sanitization, retention enforcement). Select when handling trade secrets, proprietary, or contractually confidential data.

**Processing Integrity (PI1)** — PI1.1 accuracy (input validation, processing checks, output verification), PI1.2 completeness (transaction monitoring, reconciliation, error handling), PI1.3 timeliness (SLA monitoring, delay alerts, batch job monitoring), PI1.4 authorization (processing authorization, segregation of duties). Select when data accuracy is critical (financial processing, healthcare records, analytics platforms).

**Privacy (P1-P8)** — P1 Notice, P2 Choice & Consent, P3 Collection, P4 Use/Retention/Disposal, P5 Access, P6 Disclosure & Notification, P7 Quality, P8 Monitoring & Enforcement. Select when processing PII and customers expect privacy assurance (complements GDPR compliance).

## Control Matrix Generation

A control matrix maps each TSC criterion to specific controls, owners, evidence, and testing procedures. Each entry records: Control ID (e.g. SEC-001, AVL-003), TSC mapping (e.g. CC6.1, A1.2), control description, control type (Preventive, Detective, or Corrective), owner, frequency (Continuous/Daily/Weekly/Monthly/Quarterly/Annual), evidence type (Screenshot/Log/Policy/Config/Ticket), and testing procedure.

Naming convention by category: SEC-### (Security), AVL-### (Availability), CON-### (Confidentiality), PRI-### (Processing Integrity), PRV-### (Privacy).

Workflow: select applicable TSC categories based on business needs; build a baseline matrix covering every selected criterion; customize controls to match the actual environment; assign owners and evidence requirements; validate that every selected TSC criterion has at least one control.

## Gap Analysis Workflow

**Phase 1 — current state assessment:** document existing controls (inventory policies, procedures, technical controls); map them to TSC; collect evidence samples proving controls exist and operate; interview control owners to verify understanding and execution.

**Phase 2 — gap identification:** classify each gap as a missing control (no corresponding TSC control), partially implemented (exists but lacks evidence/consistency), a design gap (doesn't adequately address the criteria), or — Type II only — an operating gap (designed correctly but not operating effectively).

**Phase 3 — remediation planning:** for each gap, record a Gap ID, affected TSC criteria, gap description, remediation action, owner, priority (Critical/High/Medium/Low), target date, and dependencies.

**Phase 4 — timeline:** Critical gaps target 2-4 weeks, High 4-8 weeks, Medium 8-12 weeks, Low 12-16 weeks.

## Evidence Collection

Primary/secondary evidence by control area: Access Management (user access reviews, provisioning tickets / role matrix, access logs); Change Management (change tickets, approvals / deployment logs, test results); Incident Response (incident tickets, postmortems / runbooks, escalation records); Vulnerability Management (scan reports, patch records / remediation timelines); Encryption (config screenshots, certificate inventory / key rotation logs); Backup & Recovery (backup logs, DR test results / recovery time measurements); Monitoring (alert configs, dashboard screenshots / on-call schedules); Policy Management (signed policies, version history / training completion); Vendor Management (vendor assessments, SOC 2 reports / contract reviews, risk registers).

Automation opportunities: integrate IAM with ticketing for automatic quarterly access-review triggers; use infrastructure-as-code snapshots/compliance-as-code for configuration evidence; run scheduled vulnerability scans with auto-generated reports; rely on git-based audit trails (commits, PRs, approvals) for change management; build automated SLA dashboards for uptime; run automated restore tests with success/failure logging for backup verification.

Move from point-in-time to continuous compliance via automated evidence gathering on a schedule, real-time control dashboards, alert-based monitoring when a control drifts out of compliance, and a centralized, timestamped evidence repository.

## Audit Readiness Checklist

Pre-audit preparation (4-6 weeks before): all controls documented with descriptions/owners/frequencies; evidence collected for the full observation period (Type II); control matrix reviewed and gaps remediated; policies signed and distributed within the last 12 months; access reviews completed within the required frequency; vulnerability scans current (no critical/high unpatched beyond SLA); incident response plan tested within 12 months; vendor risk assessments current for all subservice organizations; DR/BCP tested and documented within 12 months; employee security training completed org-wide.

Readiness scoring: 90-100% Audit Ready (proceed with confidence); 75-89% Minor Gaps (address before scheduling); 50-74% Significant Gaps (remediation required); <50% Not Ready (major program build-out needed).

Common findings and prevention: incomplete access reviews (manual process, no reminders) → automate quarterly review triggers; missing change approvals (emergency changes bypass process) → define an emergency-change procedure with post-hoc approval; stale vulnerability scans (misconfigured scanner) → automated weekly scans with alerting; unacknowledged policies (no tracking) → annual e-signature workflow; missing vendor assessments (no inventory) → maintain a vendor register with a review schedule.

## Vendor Management

Every vendor that accesses, stores, or processes customer data must be assessed: maintain a vendor inventory; classify risk by data access level; collect due diligence (SOC 2 reports, security questionnaires, certifications); ensure contractual protections (DPAs, security requirements, breach notification clauses); and reassess annually plus continuous news monitoring.

Risk tiers: Critical (processes/stores customer data) needs annual + continuous monitoring, SOC 2 Type II, penetration test, security review. High (accesses customer environment) needs annual SOC 2 Type II or equivalent plus questionnaire. Medium (indirect access/support tools) needs an annual questionnaire and security certifications. Low (no data access) needs a biennial basic questionnaire.

Subservice organizations (e.g. AWS, GCP, Azure): the **inclusive method** covers the subservice org's controls in your report (requires their cooperation); the **carve-out method** excludes their controls but references their SOC 2 report. Most companies use carve-out plus complementary user entity controls (CUECs).

## Continuous Compliance

Shift from point-in-time evidence gathering to continuous, always-current compliance: automate evidence collection on a schedule, maintain live control dashboards, alert on control drift, and keep every evidence artifact timestamped and centrally stored so audit readiness is a permanent state rather than a pre-audit scramble.