Become a security expert.
Get the latest articles on startup security and compliance best practices delivered straight to your inbox.Get a Secureframe demo
One of the best security frameworks organizations can follow — especially those that do most of their business in North America — is System and Organization Controls 2 (SOC 2). It offers flexibility in compliance without sacrificing security rigor.
However, complying with SOC 2 requires you to undergo a deep audit of your organization’s systems, processes, and controls. Preparing for such an undertaking is no easy feat.
To help you out, we’ve compiled a checklist of pre-audit steps you can take to maximize your chance of passing that audit and gaining the ability to say you’re SOC 2 compliant.
The American Institute of Certified Public Accountants developed SOC to provide security standards for internal controls.
SOC 1 deals with financial reporting controls, but SOC 2 is concerned with information security controls — especially those surrounding customer data.
SOC 2’s compliance requirements consist of five trust service principles:
The SOC compliance audit is the process you undergo to see if you meet SOC compliance guidelines. SOC 1 audits and SOC 2 audits are for the same purpose, just for different frameworks.
At the end of the SOC 2 audit, you receive a SOC 2 report containing the auditor’s opinion about whether you adhere to the trust principles specified.
There are a few types of opinions they may offer:
There are two types: SOC 2 Type I and SOC 2 Type II.
Type II more accurately measures controls in action, whereas Type I simply assesses how well you designed controls.
Passing a SOC 2 compliance audit means you’re compliant with whichever trust principles you specified. This reassures you that your chances of going through a data breach are minimal.
You can use this as a marketing tool as well, showing prospects that you’re serious about data security.
However, the SOC 2 audit is a significant investment of time, money, and organizational resources.
Not only do you have to undergo the audit itself, but you must make extensive preparations if you want to pass. You must prepare by finding out where you are relative to what complies with your desired SOC 2 trust principles. This includes identifying the gaps and charting your course to close them before the audit.
These preparations don’t happen overnight — they can take several weeks to several months.
Even when controls are in place, you must ensure your team begins to adopt best practices for information security throughout your organization to maximize your chances of passing the audit.
Before the audit, your auditor will likely work with you to set up an audit timeframe that works for both parties.
They may also talk you through the audit process. This will ensure that you know what to expect. The auditor may even ask for some initial information to help things go more smoothly.
Once they arrive, here’s the general process:
1. The security questionnaire
Many auditing firms start by administering a questionnaire to you and your team.
This contains many questions regarding company policies, procedures, IT infrastructure, and controls.
Getting your team into good security habits as early as possible before the audit helps out here. They’ll be able to answer questions with confidence.
2. Gathering evidence of controls
Next, auditors will ask your team to furnish them with evidence and documentation regarding the controls within your organization.
You need proof of every policy and internal control to demonstrate that things are up to par. The auditors use this as part of their evaluation to understand how controls are supposed to work.
During the evaluation, the auditors might ask the owners of each process within your SOC 2 audit scope to walk them through your business processes to understand them better.
SOC 2 audits are intensive. As a result, auditors often uncover matters for which they need more evidence, despite all the prep work.
They may ask your team for clarification on processes or controls, or they may want additional documentation.
In some cases, if the auditor notices obvious compliance gaps that can be fixed relatively quickly, they could ask you to remedy those before proceeding.
The auditors will document their visit as well, just in case further follow-up is needed.
5. The SOC 2 report
When the audit concludes, the auditing firm will issue you a SOC 2 audit report.
There is no formal SOC 2 certification. Instead, the main portion of the report contains the auditor’s opinion regarding the effectiveness of your internal controls as they pertain to your specified trust principles.
Since the AICPA created the SOC security guidelines, any CPA firm can perform your audit for you.
However, you’ll want to pick a CPA firm that specializes in information systems.
If you currently work with a firm that lacks CPAs with information systems knowledge and experience, your best bet is to hire a different firm for the audit. Your current firm may be able to provide some advice on preparations, but engaging with a firm that specializes in information security work will increase your chances of passing the audit.
It’s worth noting that because there’s no formal certification, hiring a CPA firm with more SOC 2 experience can bring more prestige to the end result, maximizing your reputation among customers.
That said, you will have to pay more for a more renowned firm.
Preparing for the audit can take much more work than actually undergoing it. To help you out, here is a 5-step checklist for becoming audit-ready.
The first part of preparing for your SOC 2 audit is defining the scope and objectives.
SOC 2 audits look at infrastructure, data, people, risk management policies, and software, to name a few items. You must determine who and what within each of these categories will be subject to the audit.
Additionally, picking your scope involves deciding between Type I and Type II reports.
Recall that Type I is less intensive because it only analyzes design effectiveness as of one date. That means it’s not as reputable.
On the other hand, Type II is more intensive, but it offers a better idea of how well your controls are designed and their operational effectiveness — both of which are more marketable.
Pick Type II if you care more about how well your controls function in the real world. Additionally, customers typically prefer to see Type II reports, given their increased rigor.
If you’re more concerned with simply having well-designed controls and would like to save resources, pick Type I.
SOC 2 audits evaluate your controls within the audit scope mentioned earlier against the trust services criteria set out by the AICPA.
Recall that five trust services criteria make up the SOC 2 compliance requirements:
Fortunately, you don’t have to undergo an audit for all five at once. The only mandatory principle is security.
If you’re short on resources for the audit, pick criteria alongside security that offer the highest potential ROI or those you’re close to achieving without much additional work.
You can go for all five at once if you’re able; just keep in mind that the audit scope and cost will increase with each trust principle you add.
A readiness assessment is like a practice version of the real SOC 2 audit.
You can do one on your own if you know how, but bringing in an auditor is often the better choice since they have the expertise and an outside perspective.
The auditor walks through all of your systems, processes, and controls, documenting key processes that would be in the official audit.
In the end, they issue a management letter detailing any weaknesses or deficiencies found that pertain to each trust service requirement, along with some recommendations for fixing them.
The initial readiness assessment helps you find any areas that may need improvement and gives you an idea of what the auditor will look at.
Of course, the auditor can’t help you fix the weaknesses or implement suggestions directly. This would threaten their independence — they cannot objectively audit their own work.
That part is up to you, which is where the next step comes in.
After performing that initial readiness assessment, you’ll want to perform a gap analysis.
This involves looking at where you stand based on your initial readiness assessment, what compliance looks like in terms of your SOC 2 trust criteria, then fixing any problems that you find to bring you to SOC 2 standards before the actual audit.
Gap analysis and correction can take a few months. Some activities you may identify as necessary in your gap analysis include:
Like with the readiness assessment, you may be able to outsource your gap analysis to another firm specializing in this process.
It will require additional financial investment, but it can save you time and provide you with an external expert.
Finally, after closing any gaps between you and SOC 2 compliance, you might want to do one more readiness assessment.
Hopefully, this one goes smoother, and there are far fewer weaknesses.
If there are still weaknesses present, patch those up real quick.
Once you feel you’ve addressed everything relevant to your scope and trust services criteria, you can request a formal SOC 2 audit.
Hopefully, your hard work pays off, and you get a SOC 2 report with an unmodified opinion for every trust principle you chose.
You have a lot ahead of you when preparing for your SOC 2 audit. It will take a significant investment of time, money, and mental energy. However, following the steps laid out in this checklist can make that journey a little clearer.
However, if you’d like hands-on guidance and a platform that cuts your prep time from months to weeks, Secureframe can help.