soc2-compliance

SOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.

Table of Contents

• Overview
• Trust Service Criteria
• Control Matrix Generation
• Gap Analysis Workflow
• Evidence Collection
• Audit Readiness Checklist
• Vendor Management
• Continuous Compliance
• Anti-Patterns
• Tools
• References
• Cross-References

---

Overview

What Is SOC 2?

SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.

Type I vs Type II

Aspect	Type I	Type II
Scope	Design of controls at a point in time	Design AND operating effectiveness over a period
Duration	Snapshot (single date)	Observation window (3-12 months, typically 6)
Evidence	Control descriptions, policies	Control descriptions + operating evidence (logs, tickets, screenshots)
Cost	$20K-$50K (audit fees)	$30K-$100K+ (audit fees)
Timeline	1-2 months (audit phase)	6-12 months (observation + audit)
Best For	First-time compliance, rapid market need	Mature organizations, enterprise customers

Who Needs SOC 2?

• SaaS companies selling to enterprise customers
• Cloud infrastructure providers handling customer workloads
• Data processors managing PII, PHI, or financial data
• Managed service providers with access to client systems
• Any vendor whose customers require third-party assurance

Typical Journey

Gap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal
    (4-8 wk)      (8-16 wk)     (4-6 wk)       (6-12 mo)          (4-6 wk)       (ongoing)

---

Trust Service Criteria

SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every SOC 2 report; the remaining four are optional and selected based on business need.

Security (Common Criteria CC1-CC9) — Required

The foundation of every SOC 2 report. Maps to COSO 2013 principles.

Criteria	Domain	Key Controls
CC1	Control Environment	Integrity/ethics, board oversight, org structure, competence, accountability
CC2	Communication & Information	Internal/external communication, information quality
CC3	Risk Assessment	Risk identification, fraud risk, change impact analysis
CC4	Monitoring Activities	Ongoing monitoring, deficiency evaluation, corrective actions
CC5	Control Activities	Policies/procedures, technology controls, deployment through policies
CC6	Logical & Physical Access	Access provisioning, authentication, encryption, physical restrictions
CC7	System Operations	Vulnerability management, anomaly detection, incident response
CC8	Change Management	Change authorization, testing, approval, emergency changes
CC9	Risk Mitigation	Vendor/business partner risk management

Availability (A1) — Optional

Criteria	Focus	Key Controls
A1.1	Capacity management	Infrastructure scaling, resource monitoring, capacity planning
A1.2	Recovery operations	Backup procedures, disaster recovery, BCP testing
A1.3	Recovery testing	DR drills, failover testing, RTO/RPO validation

Select when: Customers depend on your uptime; you have SLAs; downtime causes direct business impact.

Confidentiality (C1) — Optional

Criteria	Focus	Key Controls
C1.1	Identification	Data classification policy, confidential data inventory
C1.2	Protection	Encryption at rest and in transit, DLP, access restrictions
C1.3	Disposal	Secure deletion procedures, media sanitization, retention enforcement

Select when: You handle trade secrets, proprietary data, or contractually confidential information.

Processing Integrity (PI1) — Optional

Criteria	Focus	Key Controls
PI1.1	Accuracy	Input validation, processing checks, output verification
PI1.2	Completeness	Transaction monitoring, reconciliation, error handling
PI1.3	Timeliness	SLA monitoring, processing delay alerts, batch job monitoring
PI1.4	Authorization	Processing authorization controls, segregation of duties

Select when: Data accuracy is critical (financial processing, healthcare records, analytics platforms).

Privacy (P1-P8) — Optional

Criteria	Focus	Key Controls
P1	Notice	Privacy policy, data collection notice, purpose limitation
P2	Choice & Consent	Opt-in/opt-out, consent management, preference tracking
P3	Collection	Minimal collection, lawful basis, purpose specification
P4	Use, Retention, Disposal	Purpose limitation, retention schedules, secure disposal
P5	Access	Data subject access requests, correction rights
P6	Disclosure & Notification	Third-party sharing, breach notification
P7	Quality	Data accuracy verification, correction mechanisms
P8	Monitoring & Enforcement	Privacy program monitoring, complaint handling

Select when: You process PII and customers expect privacy assurance (complements GDPR compliance).

---

Control Matrix Generation

A control matrix maps each TSC criterion to specific controls, owners, evidence, and testing procedures.

Matrix Structure

Field	Description
Control ID	Unique identifier (e.g., SEC-001, AVL-003)
TSC Mapping	Which criteria the control addresses (e.g., CC6.1, A1.2)
Control Description	What the control does
Control Type	Preventive, Detective, or Corrective
Owner	Responsible person/team
Frequency	Continuous, Daily, Weekly, Monthly, Quarterly, Annual
Evidence Type	Screenshot, Log, Policy, Config, Ticket
Testing Procedure	How the auditor verifies the control

Control Naming Convention

{CATEGORY}-{NUMBER}
SEC-001 through SEC-NNN  → Security
AVL-001 through AVL-NNN  → Availability
CON-001 through CON-NNN  → Confidentiality
PRI-001 through PRI-NNN  → Processing Integrity
PRV-001 through PRV-NNN  → Privacy

Workflow

1. Select applicable TSC categories based on business needs
2. Run control_matrix_builder.py to generate the baseline matrix
3. Customize controls to match your actual environment
4. Assign owners and evidence requirements
5. Validate coverage — every selected TSC criterion must have at least one control

---

Gap Analysis Workflow

Phase 1: Current State Assessment

1. Document existing controls — inventory all security policies, procedures, and technical controls
2. Map to TSC — align existing controls to Trust Service Criteria
3. Collect evidence samples — gather proof that controls exist and operate
4. Interview control owners — verify understanding and execution

Phase 2: Gap Identification

Run gap_analyzer.py against your current controls to identify:

• Missing controls — TSC criteria with no corresponding control
• Partially implemented — Control exists but lacks evidence or consistency
• Design gaps — Control designed but does not adequately address the criteria
• Operating gaps (Type II only) — Control designed correctly but not operating effectively

Phase 3: Remediation Planning

For each gap, define:

Field	Description
Gap ID	Reference identifier
TSC Criteria	Affected criteria
Gap Description	What is missing or insufficient
Remediation Action	Specific steps to close the gap
Owner	Person responsible for remediation
Priority	Critical / High / Medium / Low
Target Date	Completion deadline
Dependencies	Other gaps or projects that must complete first

Phase 4: Timeline Planning

Priority	Target Remediation
Critical	2-4 weeks
High	4-8 weeks
Medium	8-12 weeks
Low	12-16 weeks

---

Evidence Collection

Evidence Types by Control Category

Control Area	Primary Evidence	Secondary Evidence
Access Management	User access reviews, provisioning tickets	Role matrix, access logs
Change Management	Change tickets, approval records	Deployment logs, test results
Incident Response	Incident tickets, postmortems	Runbooks, escalation records
Vulnerability Management	Scan reports, patch records	Remediation timelines
Encryption	Configuration screenshots, certificate inventory	Key rotation logs
Backup & Recovery	Backup logs, DR test results	Recovery time measurements
Monitoring	Alert configurations, dashboard screenshots	On-call schedules, escalation records
Policy Management	Signed policies, version history	Training completion records
Vendor Management	Vendor assessments, SOC 2 reports	Contract reviews, risk registers

Automation Opportunities

Area	Automation Approach
Access reviews	Integrate IAM with ticketing (automatic quarterly review triggers)
Configuration evidence	Infrastructure-as-code snapshots, compliance-as-code tools
Vulnerability scans	Scheduled scanning with auto-generated reports
Change management	Git-based audit trail (commits, PRs, approvals)
Uptime monitoring	Automated SLA dashboards with historical data
Backup verification	Automated restore tests with success/failure logging

Continuous Monitoring

Move from point-in-time evidence collection to continuous compliance:

1. Automated evidence gathering — scripts that pull evidence on schedule
2. Control dashboards — real-time visibility into control status
3. Alert-based monitoring — notify when a control drifts out of compliance
4. Evidence repository — centralized, timestamped evidence storage

---

Audit Readiness Checklist

Pre-Audit Preparation (4-6 Weeks Before)

• All controls documented with descriptions, owners, and frequencies
• Evidence collected for the entire observation period (Type II)
• Control matrix reviewed and gaps remediated
• Policies signed and distributed within the last 12 months
• Access reviews completed within the required frequency
• Vulnerability scans current (no critical/high unpatched > SLA)
• Incident response plan tested within the last 12 months
• Vendor risk assessments current for all subservice organizations
• DR/BCP tested and documented within the last 12 months
• Employee security training completed for all staff

Readiness Scoring

Score	Rating	Meaning
90-100%	Audit Ready	Proceed with confidence
75-89%	Minor Gaps	Address before scheduling audit
50-74%	Significant Gaps	Remediation required
< 50%	Not Ready	Major program build-out needed

Common Audit Findings

Finding	Root Cause	Prevention
Incomplete access reviews	Manual process, no reminders	Automate quarterly review triggers
Missing change approvals	Emergency changes bypass process	Define emergency change procedure with post-hoc approval
Stale vulnerability scans	Scanner misconfigured	Automated weekly scans with alerting
Policy not acknowledged	No tracking mechanism	Annual e-signature workflow
Missing vendor assessments	No vendor inventory	Maintain vendor register with review schedule

---

Vendor Management

Third-Party Risk Assessment

Every vendor that accesses, stores, or processes customer data must be assessed:

1. Vendor inventory — maintain a register of all service providers
2. Risk classification — categorize vendors by data access level
3. Due diligence — collect SOC 2 reports, security questionnaires, certifications
4. Contractual protections — ensure DPAs, security requirements, breach notification clauses
5. Ongoing monitoring — annual reassessment, continuous news monitoring

Vendor Risk Tiers

Tier	Data Access	Assessment Frequency	Requirements
Critical	Processes/stores customer data	Annual + continuous monitoring	SOC 2 Type II, penetration test, security review
High	Accesses customer environment	Annual	SOC 2 Type II or equivalent, questionnaire
Medium	Indirect access, support tools	Annual questionnaire	Security certifications, questionnaire
Low	No data access	Biennial questionnaire	Basic security questionnaire

Subservice Organizations

When your SOC 2 report relies on controls at a subservice organization (e.g., AWS, GCP, Azure):

• Inclusive method — your report covers the subservice org's controls (requires their cooperation)
• Carve-out method — your report excludes their controls but references their SOC 2 report
• Most companies use carve-out and include complementary user entity controls (CUECs)

---

Continuous Compliance

From Point-in-Time to Continuous

Aspect	Point-in-Time	Continuous
Evidence collection	Manual, before audit	Automated, ongoing
Control monitoring	Periodic review	Real-time dashboards
Drift detection	Found during audit	Alert-based, immediate
Remediation	Reactive	Proactive
Audit preparation	4-8 week scramble	Always ready

Implementation Steps

1. Automate evidence gathering — cron jobs, API integrations, IaC snapshots
2. Build control dashboards — aggregate control status into a single view
3. Configure drift alerts — notify when controls fall out of compliance
4. Establish review cadence — weekly control owner check-ins, monthly steering
5. Maintain evidence repository — centralized, timestamped, auditor-accessible

Annual Re-Assessment Cycle

Quarter	Activities
Q1	Annual risk assessment, policy refresh, vendor reassessment launch
Q2	Internal control testing, remediation of findings
Q3	Pre-audit readiness review, evidence completeness check
Q4	External audit, management assertion, report distribution

---

Anti-Patterns

Anti-Pattern	Why It Fails	Better Approach
Point-in-time compliance	Controls degrade between audits; gaps found during audit	Implement continuous monitoring and automated evidence
Manual evidence collection	Time-consuming, inconsistent, error-prone	Automate with scripts, IaC, and compliance platforms
Missing vendor assessments	Auditors flag incomplete vendor due diligence	Maintain vendor register with risk-tiered assessment schedule
Copy-paste policies	Generic policies don't match actual operations	Tailor policies to your actual environment and technology stack
Security theater	Controls exist on paper but aren't followed	Verify operating effectiveness; build controls into workflows
Skipping Type I	Jumping to Type II without foundational readiness	Start with Type I to validate control design before observation
Over-scoping TSC	Including all 5 categories when only Security is needed	Select categories based on actual customer/business requirements
Treating audit as a project	Compliance degrades after the report is issued	Build compliance into daily operations and engineering culture

---

Tools

Control Matrix Builder

Generates a SOC 2 control matrix from selected TSC categories.

# Generate full security matrix in markdown
python scripts/control_matrix_builder.py --categories security --format md

# Generate matrix for multiple categories as JSON
python scripts/control_matrix_builder.py --categories security,availability,confidentiality --format json

# All categories, CSV output
python scripts/control_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv

Evidence Tracker

Tracks evidence collection status per control.

# Check evidence status from a control matrix
python scripts/evidence_tracker.py --matrix controls.json --status

# JSON output for integration
python scripts/evidence_tracker.py --matrix controls.json --status --json

Gap Analyzer

Analyzes current controls against SOC 2 requirements and identifies gaps.

# Type I gap analysis
python scripts/gap_analyzer.py --controls current_controls.json --type type1

# Type II gap analysis (includes operating effectiveness)
python scripts/gap_analyzer.py --controls current_controls.json --type type2 --json

---

References

• Trust Service Criteria Reference — All 5 TSC categories with sub-criteria, control objectives, and evidence examples
• Evidence Collection Guide — Evidence types per control, automation tools, documentation requirements
• Type I vs Type II Comparison — Detailed comparison, timeline, cost analysis, and upgrade path

---

Cross-References

• gdpr-dsgvo-expert — SOC 2 Privacy criteria overlaps significantly with GDPR requirements; use together when processing EU personal data
• information-security-manager-iso27001 — ISO 27001 Annex A controls map closely to SOC 2 Security criteria; organizations pursuing both can share evidence
• isms-audit-expert — Audit methodology and finding management patterns transfer directly to SOC 2 audit preparation