You’ve spent countless hours preparing to get your SOC 2 report. How do you know if you’re ready for a successful audit and a clean report?

A SOC 2 self-assessment can give you a clear idea of how well prepared you are for an external audit, and help you pinpoint gaps in your security posture so you can fix them before your audit.

Read on for a step-by-step guide to conducting a proper self-assessment, plus a SOC 2 readiness checklist, so you can go into your audit with confidence.

What is a SOC 2 audit?

A SOC 2 (System and Organization Controls 2) report is an attestation by an accredited CPA firm. This audit report verifies that your service organization has the appropriate cybersecurity in place to protect customer data.

There are two types of SOC 2 reports: SOC 2 Type I, which evaluates your security posture at a specific point in time, and SOC 2 Type II, which evaluates your security posture as it functions over a period of time.

SOC 2 readiness assessment vs SOC 2 self-assessment: What’s the difference? 

A readiness assessment is a formal examination conducted by an auditor accredited by the American Institute of Certified Public Accountants (AICPA). It’s like a dress rehearsal for your formal audit, and can help you determine whether your organization’s controls satisfy your selected Trust Services Criteria and are sufficient to prove compliance. A readiness assessment will also reveal any gaps in your data security that need to be fixed. 

Readiness assessments typically cost between $10-17k, depending on the size of your organization and the scope of your audit. 

Instead of hiring a consultant to complete a full readiness assessment, some organizations choose to do an internal SOC 2 self-assessment. During the self-assessment, the organization will map existing information security controls and policies to their selected TSC, identify any gaps, and create a remediation plan ahead of their formal SOC 2 audit. 

Deciding which option is best for your organization often comes down to available resources. A readiness assessment is an additional expense, while self-assessments come with productivity costs and depend on having someone on staff with the expertise required. 

Whichever path you choose, it’s best to complete your assessment several months before you plan to undergo your formal compliance audit. You’ll need time to close any gaps you uncover in your systems and internal controls. 

How to conduct a SOC 2 self-assessment in 4 steps

If you’ve decided a SOC 2 self-assessment is the right choice for your company, you’re probably wondering how to go about completing one. Essentially, a self-assessment is about comparing where you are with where you need to be, and then creating a tangible plan to get there.

Here are the four main steps of a self-assessment:

Step 1: Define audit scope

You’ll need to know what you’re preparing for before you can decide if you’re ready. Do you need a Type I or Type II report? Which Trust Services Criteria (formerly Trust Services Principles) do you need to include in your SOC audit? 

There are a few ways to decide which TSC are relevant to your organization. Every SOC 2 audit needs to include Security, but any TSC beyond that are optional and will likely be determined by the type of services you provide and your customer requirements. 

For example, if your services guarantees 99.9% uptime, you’ll likely need the Availability criteria. If your organization handles confidential information like financial reporting or intellectual property, you’ll likely need to add Confidentiality. 

Second, consider which TSC your customers expect to see on a report. Which TSC are they most interested in seeing you comply with? 

Next you’ll need to decide which type of SOC 2 report you’ll pursue: a Type I or Type II. 

If your organization needs a SOC 2 report urgently it can be tempting to opt for the faster, cheaper Type I report. Just be aware that many prospective customers are rejecting Type I reports, and it’s likely you’ll need a Type 2 report at some point.

Choosing to get your Type 2 report can save your organization time and money in the long run by completing just one audit instead of two. We find the best options for companies with an urgent need for a SOC 2 report to be a Type 2 report with a shorter, 3-month review period. 

Step 2: Map compliance requirements to your current controls

Once you know which TSC you’re including in your audit report, you can take stock of your current system, controls, and security policies to compare where you are with where you need to be. 

Every SOC 2 audit will include the Common Criteria, also known as the CC-series. At the very least, your controls should cover:

• CC1: Control environment
  How does the organization prove it values security and integrity?
• CC2: Communication and Information
  Does the organization have policies and processes in place to promote security? How are those policies and processes communicated to employees and external stakeholders?
• CC3: Risk Assessment
  Does the organization have a formal, thoughtful approach to risk management?
• CC4: Monitoring Controls
  How does the organization assess whether controls are functioning as intended?
• CC5: Control Activities
  Has the organization implemented adequate controls and processes to mitigate risk?
• CC6: Logical and Physical Access Controls
  How does the organization protect data from unauthorized access?
• CC7: System Operations
  Does the organization monitor systems to ensure they’re functioning properly? Are incident response and disaster recovery policies in place to ensure they continue to function properly?
• CC8: Change Management
  Does the organization test and approve significant changes to systems and processes before implementing them?
• CC9: Risk Mitigation
  Does the organization consider ways to reduce risk through business processes and vendor management?

Most organizations create an evidence collection spreadsheet listing each TSC requirement and the corresponding policies and/or controls. This makes it easier to spot where the gaps lie and create an action plan. 

Many SOC 2 readiness assessments also include interviews with employees and control owners to discuss and observe how controls function during day-to-day work. You may have a security policy or process in place, but it won’t do your organization any good if no one is actually following it.

Step 3: Close any gaps

For every gap you identify, you’ll need to create a remediation plan that explains what you’ll do to satisfy that requirement, the individual responsible for overseeing its implementation, and the timeline for getting it done. Thoroughly document your remediation plans, including any meeting minutes with stakeholders to discuss progress, decisions, and next steps.

Step 4: Communicate results and remediation plans

Share the results of the self-assessment with stakeholders, including those responsible for remediating identified gaps. Give an overview of the self-assessment goals, internal controls evaluated, any new or unresolved gaps that were identified, and the plans for remediation. 

It’s tempting to view these meetings as simple status reports, but they’re also a valuable opportunity to build a strong security culture and keep your entire organization aligned on the importance of compliance.

Get audit-ready faster with Secureframe

Whether you’re pursuing SOC 2, PCI DSS, ISO 27001, or HIPAA certification, Secureframe streamlines the readiness assessment process.

Our compliance automation platform integrates with hundreds of popular business tools to scan your cloud infrastructure and automatically gauge your audit readiness. Track your progress toward compliance with an easy-to-read dashboard that takes the guesswork out of audit prep. Request a demo today to learn more.