SOC 2 Type II reports evaluate the operating effectiveness of controls over a period of time (typically 6-12 months). Preparation is critical for a successful audit.
Trust Service Criteria
Security (Common Criteria)
Required for all SOC 2 reports:
- Access controls and authentication mechanisms
- Network security and firewalls
- Change management processes
- Incident response procedures
- Risk assessment program
Availability
- System uptime monitoring and SLAs
- Disaster recovery and business continuity plans
- Capacity planning and performance monitoring
Processing Integrity
- Quality assurance processes
- Data validation and error handling
- Processing monitoring and reconciliation
Confidentiality
- Data classification policies
- Encryption at rest and in transit
- Secure data disposal procedures
Privacy
- Privacy notice and consent management
- Data subject rights processes
- Data retention and deletion policies
Pre-Audit Checklist
- Perform a readiness assessment (gap analysis)
- Remediate identified gaps
- Establish an evidence collection process
- Document all policies and procedures
- Conduct internal control testing
- Select an experienced audit firm
- Define the audit period and scope