Before You Start
- Executive commitment to achieving SOC 2 certification with allocated budget and resources
- An understanding of which SOC 2 trust service criteria are relevant to your business
- An inventory of systems and processes that will be in scope for the audit
- A project manager or internal champion to drive the preparation effort
Understand SOC 2 and select your trust service criteria
SOC 2 is an auditing framework developed by the AICPA that evaluates an organization controls over its systems and data based on five trust service criteria. Security, also known as the common criteria, is required for every SOC 2 audit and covers protection against unauthorized access. Availability covers whether systems are operational and usable as committed. Processing Integrity covers whether system processing is complete, valid, accurate, and timely. Confidentiality covers whether information designated as confidential is protected. Privacy covers whether personal information is collected, used, retained, disclosed, and disposed of according to the organization privacy notice. Most organizations start with Security only or Security plus Availability. Choose the criteria that align with your customer contracts and market expectations. A SOC 2 Type I report evaluates control design at a point in time, while a Type II report evaluates both design and operating effectiveness over a period, typically six to twelve months. Most prospects and customers require a Type II report.
Perform a readiness assessment and gap analysis
Before engaging an auditor, conduct an internal readiness assessment to identify gaps. Map each SOC 2 criteria point to your existing controls. The security criteria covers areas including risk assessment, logical and physical access controls, system operations, change management, and risk mitigation. For each control area, document whether you have a formal policy, whether the control is implemented and operating, and whether you have evidence of its operation. Common gaps for SMBs include lack of formal policies and procedures, inconsistent access reviews, missing change management documentation, incomplete vendor risk management, and absence of a formal risk assessment process. Categorize gaps by effort to remediate so you can create a realistic timeline. Consider engaging a SOC 2 readiness consultant to help with this assessment if you lack internal expertise, as this is different from your audit firm and there is no conflict of interest.
Implement controls and remediate gaps
Address the gaps identified in your readiness assessment, starting with the foundational controls. Write and formalize the required policies including information security policy, access control policy, change management policy, incident response policy, vendor management policy, and data retention policy. Implement technical controls including MFA on all systems, endpoint protection, encryption at rest and in transit, centralized logging and monitoring, automated patch management, and backup with tested recovery. Implement process controls including quarterly access reviews documented with evidence, change management procedures with approval records, annual risk assessments, vendor security assessments for third parties who access your data, and security awareness training for all employees. For each control, think about what evidence the auditor will need and build evidence collection into the normal operation of the control from day one.
Set up evidence collection and documentation
SOC 2 auditors need evidence that controls are not just designed but operating effectively over the audit period. For each control, define what evidence will be collected, how it will be collected, how often, and where it will be stored. Use a GRC platform like Vanta, Drata, Secureframe, or Tugboat Logic to automate evidence collection from your cloud services and infrastructure. These platforms connect to AWS, Azure, Google Cloud, GitHub, and other services to continuously collect evidence of control operation. For controls that cannot be automated, create manual evidence collection procedures and assign owners. Common evidence types include access review completion records with screenshots, change management tickets showing approval workflows, backup completion logs and restoration test records, security training completion certificates, vulnerability scan reports and remediation records, and incident response test documentation. Store all evidence in a centralized repository organized by control objective.
Select an audit firm and plan the audit
Choose a CPA firm with SOC 2 audit experience that fits your organization. The firm must be licensed and independent, meaning they cannot audit controls they helped implement. Get quotes from three to four firms. Evaluate them based on their experience with companies your size and in your industry, their familiarity with your technology stack, their communication style and responsiveness during the proposal process, their timeline and flexibility, and their pricing structure. Typical SOC 2 Type II audits for SMBs cost between twenty thousand and sixty thousand dollars depending on scope and complexity. Plan the audit timeline. A Type II audit requires a minimum observation period, usually three to six months for a first audit. Work backward from your target report date to determine when the observation period must begin. Schedule a planning meeting with the auditor before the observation period starts to align on scope, criteria, control descriptions, and evidence requirements.
Execute the audit period and support the auditor
During the observation period, operate your controls consistently and collect evidence continuously. Assign an internal point of contact who manages the auditor relationship, coordinates evidence requests, and tracks remediation of any issues found during the audit. The auditor will request evidence in batches, typically focusing on different control areas over the engagement. Respond to evidence requests promptly and completely. If the auditor identifies a control gap or exception, you have the opportunity to remediate it and demonstrate the corrected control before the report is finalized. Common issues discovered during audits include inconsistent execution of quarterly access reviews, missing change management approvals for production deployments, gaps in security awareness training completion, and incomplete vendor risk assessments. After the audit fieldwork is complete, review the draft report carefully, especially the system description and any noted exceptions. Negotiate the language of any exceptions to ensure they accurately represent the situation. Once finalized, share the SOC 2 report with customers and prospects through a secure portal or NDA-protected distribution.
Common Mistakes to Avoid
Starting the audit without a readiness assessment, discovering major gaps during the observation period
Treating SOC 2 as a one-time project rather than an ongoing program of continuous control operation
Not automating evidence collection, leading to a scramble to gather documentation at audit time
Choosing the cheapest audit firm without verifying their SOC 2 experience and quality
Waiting too long to remediate gaps, compressing the observation period and rushing the process
Get your Cyber Defense Score™ in 60 seconds.
100 tools. No installation. No credit card.
Get My Cyber Defense Score™ →