SOC 2 Compliance Checklist: 51 Questions to Prepare for a SOC 2 Audit

Getting a SOC 2 report is an important step for any service-based organization.

But, before spending money to hire an auditor, the question is, are you even ready for the audit?

After all, there’s no one-size-fits-all approach. Depending on your organizational structure, industry, and a myriad of other factors, requirements may vary. 

Does that mean you can’t do anything to prepare?

Not quite.

We’ll cover some helpful questions that will help you prepare for your SOC audit, as well as some recommendations and best practices to consider. 

Quick recap: what is SOC 2?

SOC stands for Service Organization Controls, and it’s a report that aims to provide more clarity on the security controls used by service-based organizations. 

Being specific, SOC 2 focuses on the five “Trust Principles” defined by the AICPA (American Institute of Certified Public Accountants), which are:

• Security: The procedures you have in place to protect the integrity of user information
• Availability: How available and accessible your services are to users
• Confidentiality: How you handle confidential information
• Processing integrity: Making sure the data you’re processing is provided in a timely, accurate manner
• Privacy: Policies and practices you use to keep your users’ information anonymous and protected 

We’ll cover these principles a bit more in-depth later, but first, let’s answer a crucial question. 

Why does your organization need a SOC 2 report?

If you’re a service-based organization and provide services that directly affect users’ operational efficiency (e.g., cloud service provider, SaaS, data center, etc.), you probably need to become SOC 2 compliant. 

At some point, your users may request a SOC 2 report for their own auditing processes. Not providing this report may hurt your client relationships and harm your reputation. 

A SOC audit will help you better understand the current performance of your security controls and spot potential issues. This gives you a chance to fix them before they start snowballing. 

In short, becoming SOC 2 compliant comes with many benefits and zero disadvantages.

Some of the main benefits of a SOC 2 report include:

• Build stronger client relationships: Having a SOC 2 audit shows your clients that you care about their security and integrity 
• Prevent security breaches: A SOC report will help you make sure you’re meeting the highest standards and avoid any data breach 
• Get valuable information about your business: Learn more about your overall performance and improve your controls continuously

Who runs SOC 2 examinations?

SOC 2 examinations are considered “attestation” audits, which means an external, third-party auditor should come into your organization, analyze the controls you have in place, and issue an opinion. 

This opinion often includes:

• The scope of the engagement (how long the audit will take)
• A description of the organization’s responsibilities
• The design of the controls being tested
• A description provided by the organization’s management
• The report type that will be issued
• The actual auditor’s opinion regarding the performance of the controls

Keep in mind; SOC 2 examinations are governed by the AICPA and should be performed by a certified public accountant (CPA).

A SOC 2 preparation guide

Preparing for a SOC 2 audit without any guidance is like exploring a dangerous jungle without a map.

To help you avoid that kind of trouble, we’ve put together a list of 41 questions to prepare for a SOC 2 report. 

This step-by-step guide will break down the entire process into seven categories:

1. Report types
2. Scoping
3. Controls
4. Trust service principles
5. Timing
6. Readiness
7. Process

Let’s get straight into it.

Report types

First, you need to understand the different types of SOC 2 reports to decide what you need right now. 

There are two types of SOC 2 reports: Type I and Type II.

The main difference between report types lies in the duration of each.

SOC 2 Type I reports explore your organization’s controls at a single point in time, whereas SOC 2 Type II reports test the performance of your controls over six to 12 months. 

At this stage, some helpful questions may include:

• Have you had a SOC 2 examination before? 
• Do you have a clear structure in your organization?
• Do you have a dedicated team to develop and implement policies?
• Do you have some background in screening procedures?
• Does your organization have designated employees to implement industry standards?
• Do your employees understand their roles and responsibilities when implementing controls?
• Do you have a system in place to communicate system changes?

If the answer to most of these questions is a clear “no,” then you probably need to start with a SOC 2 Type I report. 

Starting with Type I will help you determine the current performance of your controls. 

SOC 2 Type II reports are a bit more complex and require more time, which may not be convenient if you don’t have all the required structures in place before the examination.

Scoping

Scoping refers to what you’ll include in your report, as well as how long it will take. Describe the controls you want to test and define why they matter from the user’s perspective. 

This description should be brief and must answer the following questions:

• Which of the five trust principles will you test?
• What’s the system in scope? (i.e., people, specific applications or features, locations, etc.)
• What’s the actual timeline of the audit? (This will be dictated by the report type you want)

Readiness assessment

A readiness assessment is an examination performed by the service auditor to determine how ready your organization is for a SOC 2 examination and help you spot potential gaps. 

This will help you better understand the current state of your organization’s controls and better prepare for the actual audit. 

A readiness assessment helps you answer:

• Is your organization ready for a SOC 2 examination?
• Are your current controls enough?
• Are there any gaps you need to fix prior to your SOC 2 examination?

Controls

Once you have defined the scope of your report, it’s time to describe the actual controls you’re going to test. 

Let’s break down the different components you should consider.

Description and design

This is a complete description of each internal control you want to test and how it impacts user operations and the bottom line. 

Some helpful questions include:

• What are the names of the controls you’ll test?
• How do those controls affect user operations?
• Do these controls rely on any third-party software? If so, what controls do you have in place to prevent security breaches?
• Why and how are these controls crucial for users?

Risk assessment

The risk assessment is a description of all the risks involved in the implementation of your controls. You must perform a risk assessment to evaluate potential threats in your systems and develop contingency plans to protect users against such threats.

Some helpful questions include:

• Do you understand the risks associated with your system and controls?
• Have you identified the potential impact these risks may have on your system?
• Do you have contingency plans in place to mitigate risks?
• How often do you perform risk assessments to identify potential threats?
• How are you handling environmental risks?

Physical and logical access controls

You need to define who can access different areas of your business involved in the implementation of your controls and add permission levels to protect data. 

Some useful questions may include:

• Are there any physical restrictions and controls in your organization?
• Are there any logical restrictions and controls in your organization?
• Do you have pertinent access controls in place?
• Have you set permission levels based on roles and responsibilities?

Trust service principles

As we stated earlier, SOC 2 reports must meet the specified trust service principles defined by the AICPA. 

This includes:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

Security is the only principle required by the AICPA. That’s why it’s often referred to as “common criteria.”

The AICPA provides no specified guidelines regarding the principles you should include in your SOC 2 report. The principles you choose will be based on customer demands and specific industry regulations. 

We suggest you analyze the service you’ll test and try to determine which principles are more relevant to users.

For example, a cloud service provider might need to consider the availability and security principles, while a payment processor system may need to include different principles, like processing integrity and privacy. 

That said, some helpful questions for each principle include:

Security

Security is the only required principle by the AICPA, so you must pay special attention to the security controls you have in place to protect users’ sensitive information. 

Here are some helpful questions to start:

• What are you doing to monitor and prevent intrusions and cyber attacks?
• Do you have specific procedures to handle incidents?
• Are your most important applications updated on a regular basis?
• How do you handle issues and inefficiencies in your systems?
• Do you have any backup and recovery procedures in place?
• Have you tested and documented your security procedures?
• How do you address unauthorized access?

Availability

Availability refers to how accessible your system is for user operations. For example, if you offer payroll management services to large manufacturing companies, you must ensure that your system is available whenever your clients need it. 

Some helpful questions may include:

• Are your services available at all times? 
• Are your services restricted to some people?
• How do you handle service issues that affect your availability?

Processing integrity

Processing integrity aims to help service users protect the integrity of their information. For example, if you offer a payment gateway service, your system must process customer data quickly, securely, and accurately.

Some helpful questions to ask include:

• Are your processing systems working reliably and consistently? 
• Are your processing systems providing timely, accurate data to users? 
• How do you handle system failures and issues?
• Do you have specific procedures in place to correct errors quickly?

Confidentiality

If you’re handling confidential information about your clients or helping clients manage their users’ sensitive information, you must comply with the confidentiality principle. 

Some helpful questions include:

• How are you handling and processing confidential data? 
• Is data protected and classified all the time?
• Do you have strict permission levels in place to avoid unauthorized access?

Privacy

Finally, privacy refers to the protection and anonymity of user information. That is, the procedures and policies you have in place to collect, process, and use personal information. 

These policies must meet the criteria established by the Generally Accepted Privacy Principles (GAPP).

Here are some helpful questions:

• Have you tested and documented a clear data retention policy?
• How do you process and classify personal data?
• Are you storing personal information? If so, where are you storing it, and how?
• How are you protecting users’ personal data?
• Are you GAPP compliant?

Regulatory compliance

As we mentioned earlier, the AICPA doesn’t provide clear guidelines regarding the controls you must have in place to be SOC 2 compliant. 

What works for some organizations might not work for others, and vice versa.

You need to be aware of your industry’s common legislation and security regulations and make sure that you’re compliant with them. 

Some helpful questions might include:

• Are there any specific legislation or policies in your industry that you might need to consider?
• Are there specific privacy standards you should consider? (e.g., GDPR)
• If so, how are you dealing with such standards, regulations, and policies?

The bottom line?

SOC 2 reports will help your customers understand the controls you have in place to protect their valuable information. By showing them that you care, you’ll be able to build long-lasting relationships.

Hopefully, you now have enough information to prepare for your SOC 2 audit.

If you’re looking for a platform that helps you streamline security compliance, Secureframe might be a good fit for you. 

To start, we suggest you visit our product overview page and learn more about our process. It’ll help you start on the right foot.