🛡️ SOC 2

SOC 2 Compliance Toolkit

Trust Service Criteria gap assessment, evidence checklist, and readiness scoring for SOC 2 Type II audits. Targeted at Indian SaaS companies selling to US enterprise customers.

What is SOC 2?

SOC 2 (System and Organisation Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates a service organisation's controls relevant to security, availability, processing integrity, confidentiality, and privacy — the five Trust Service Criteria (TSC).

AspectSOC 2 Type ISOC 2 Type II
What it testsDesign of controls at a point in timeDesign AND operating effectiveness over a period
Audit periodSingle date (point-in-time)Minimum 6 months, typically 12 months
Value to customersModerate — shows controls existHigh — shows controls actually worked over time
Time to achieve3–6 months9–18 months from starting
Typical useFirst SOC 2 — proof of conceptRequired by enterprise customers
Cost (approx)$10,000–$30,000$20,000–$60,000+ depending on scope

SOC 2 Scope — Which Criteria Do You Need?

Security (CC) is mandatory. The other four criteria are selected based on your service and customer requirements.

CriteriaMandatory?When to include
Security (CC) Yes — always required All SOC 2 reports must include Security
Availability (A) Include if customers depend on uptime SLAs SaaS platforms, cloud infrastructure, API providers
Processing Integrity (PI) Include if data accuracy is critical Payroll, ERP, financial processing, billing systems
Confidentiality (C) Include if you handle confidential data B2B SaaS with customer data, legal, financial data
Privacy (P) Include if you handle personal information Consumer apps, HR platforms, healthcare, fintech

Security — Common Criteria (CC) — Full Reference

CC1
Control Environment
Board oversight, organisational structure, commitment to competence, accountability. Management philosophy and risk appetite.
CC2
Communication & Information
Internal and external communication of information relevant to achieving objectives. Information security policies communicated to all staff.
CC3
Risk Assessment
Risk identification, risk analysis, and risk response. Change management risk assessment. Fraud risk assessment.
CC4
Monitoring of Controls
Ongoing and separate evaluations. Internal audit. Remediation of deficiencies.
CC5
Control Activities
Policies and procedures for control activities. Segregation of duties. Technology controls.
CC6
Logical & Physical Access
Access provisioning, MFA, termination, privileged access, encryption, physical security.
CC7
System Operations
Change management, monitoring of system performance, incident management, backup and recovery.
CC8
Change Management
Authorisation, development/testing/production separation, change approval, post-implementation review.
CC9
Risk Mitigation
Business continuity planning, vendor management, insurance.

SOC 2 Gap Assessment — Security Criteria

Check off completed items. Progress saves automatically.

Control Environment & Policies
Access Control (CC6)
Change Management (CC8)
Incident Response (CC7)
Risk Management (CC3/CC9)

Evidence Collection Checklist

Typical evidence an auditor will request for SOC 2 Type II. Collect this before your audit window begins.

Policies & Procedures
Access Control Evidence
Change Management Evidence
Monitoring & Incident Response
HR & Training
Risk & Vendor Management

Most Common SOC 2 Audit Findings

FindingCategoryWhy it failsFix
MFA not enforced for all accounts CC6 Access Control Many companies enforce MFA for most users but miss service accounts, contractor accounts, or legacy app integrations. Audit all accounts monthly. Enforce MFA at IdP level — block login without MFA, no exceptions.
Access not revoked timely on termination CC6 Access Control Manual offboarding processes miss accounts in secondary systems — Slack, GitHub, AWS, PagerDuty. Automate deprovisioning via SCIM. Audit departed employees monthly against all system access lists.
No quarterly access reviews CC6 Access Control Access reviews happen at onboarding but not reviewed thereafter. Role creep accumulates over time. Quarterly access reviews with documented approval. Use a GRC tool or spreadsheet with sign-off.
Production and development environments not separated CC8 Change Management Developers can access production directly — common in early-stage companies. Strict prod access controls. Deploy via CI/CD pipeline. Developers cannot push directly to prod.
No change approval process CC8 Change Management Changes deployed without peer review or approval, especially for "hotfixes." Require minimum one reviewer for all merges to main. No exceptions for hotfixes.
Audit logs not retained for 12 months CC7 System Operations Log retention set to 30–90 days to save cost. SOC 2 typically requires 12 months. Configure SIEM or cloud logging (CloudWatch, Stackdriver) with 12-month retention. Cost-optimise by tiering.
Security training not completed by all staff CC1 Control Environment Training completed by most staff but 100% completion rate required. New joiners often missed. Block quarterly access or send reminders. Report completion rate to management monthly.
Penetration test findings not remediated CC7 System Operations Pentest conducted but critical and high findings not fixed within the audit period. Define SLAs for pentest remediation (critical: 30 days, high: 60 days). Track in risk register.
Vendor risk not assessed CC9 Risk Mitigation Key vendors (AWS, GitHub, Stripe, Salesforce) not formally assessed or added to vendor register. Inventory all vendors handling your data. Tier by risk. Annual questionnaire for critical vendors.
No Business Continuity / DR test CC9 Risk Mitigation BCP/DR plan exists but has never been tested. Auditors want evidence of a test. Annual DR drill with documented results. Tabletop exercise counts — document it properly.