SOC 2 readiness: what to fix before the auditor arrives

SOC 2 readiness is the work you do before the formal audit starts: selecting criteria, implementing controls, and generating the evidence an auditor will sample. SOC 2 is an attestation report produced by a licensed CPA firm against the AICPA Trust Services Criteria - not a certificate, and not a checklist you can simply tick.

Type I or Type II?

• Type I assesses whether your controls are suitably designed at a single point in time. It is faster and often used to satisfy an urgent customer requirement.
• Type II assesses whether those controls operated effectively across an observation window, typically three to twelve months. This is what enterprise buyers usually want.

If a customer has not specified, assume they mean Type II.

Choosing your Trust Services Criteria

Security (the "common criteria") is mandatory. The other four are optional and should be chosen based on the promises you make to customers:

• Security - required in every SOC 2 report.
• Availability - include if you commit to uptime SLAs.
• Confidentiality - include if you handle customer data under confidentiality obligations.
• Processing Integrity - include if you process transactions where accuracy is the product.
• Privacy - include if you handle personal information and make privacy commitments.

Adding criteria you do not need expands the audit and its cost. Start with Security and add deliberately.

The readiness sequence

1. Scope the system. Define the product, infrastructure, people and data covered by the report.
2. Run a readiness assessment or gap analysis against the selected criteria.
3. Write and approve policies - access control, change management, incident response, risk assessment, vendor management, business continuity.
4. Implement the controls and, just as importantly, make them produce records automatically.
5. Run a risk assessment and document it - auditors always ask.
6. Complete vendor due diligence on your subservice organisations.
7. Open the observation window and operate cleanly throughout it.
8. Engage the CPA firm for fieldwork and evidence sampling.

The gaps that derail first audits

• Access reviews never performed. Quarterly user access reviews with documented approval are among the most sampled controls.
• Offboarding gaps. Auditors compare your HR leaver list against active accounts. Any mismatch is an exception.
• Change management without approval records. Pull requests merged without review break the control.
• No risk assessment. A documented, dated risk assessment is not optional.
• Untested backups and incident response. Auditors want evidence of a test, not the existence of a plan.
• Vendor management theatre. Collect and review subservice organisation reports rather than merely listing suppliers.

The observation window is unforgiving. A control that fails in month two of a six-month Type II window becomes an exception in your final report, so start the window only when your controls genuinely operate.

Key takeaways

• Security criteria are mandatory; add the other four only where you make those commitments.
• Type II tests operating effectiveness over time - evidence history is everything.
• Access reviews, offboarding and change approvals cause the most exceptions.
• Do not open the observation window until controls genuinely run.