SOC 2 Compliance

Overview

SOC 2 (System and Organization Controls 2) is an attestation framework from the AICPA for service organizations. An independent licensed CPA firm examines your controls against the Trust Services Criteria (the 2017 criteria with the revised points of focus issued in 2022) and issues a report. There is no SOC 2 "certificate" and no government registry: the deliverable is the auditor's report. A Type I report says controls were suitably designed at a point in time; a Type II report says they also operated effectively over an observation period. The AICPA sets no fixed minimum for that period; auditors commonly accept 3 months for a first report, 6 to 12 months is typical, and 12 months is the norm for renewals. Enterprise buyers often ask for a Type II report before signing.

Instructions

1. Scope: list the systems, people, vendors and data that deliver your service, and choose the criteria (Security always; add Availability, Confidentiality, Processing Integrity or Privacy only if customers need them).
2. Run a gap assessment against the Common Criteria below, using a readiness tool or an auditor's readiness review.
3. Write and approve the policies, then implement the missing controls (MFA, encryption, logging, change control, access reviews, vendor reviews).
4. Collect evidence continuously from the first day of the observation period, not at audit time.
5. Pick an independent CPA firm early and agree the scope, period and evidence format; compliance platforms are not auditors.
6. Fix findings, review the draft report and management assertion, and repeat annually.

Trust Service Criteria (TSC)