Soc2 Compliance

SOC 2 Compliance

SOC 2 Type I and Type II compliance preparation for SaaS companies. Covers Trust Service Criteria mapping, control matrix generation, evidence collection, gap analysis, and audit readiness assessment.

Table of Contents

• Overview
• Trust Service Criteria
• Control Matrix Generation
• Gap Analysis Workflow
• Evidence Collection
• Audit Readiness Checklist
• Vendor Management
• Continuous Compliance
• Anti-Patterns
• Tools
• References
• Cross-References

Overview

What Is SOC 2?

SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how a service organization manages customer data. It applies to any technology company that stores, processes, or transmits customer information — primarily SaaS, cloud infrastructure, and managed service providers.

Type I vs Type II

Who Needs SOC 2?

• SaaS companies selling to enterprise customers
• Cloud infrastructure providers handling customer workloads
• Data processors managing PII, PHI, or financial data
• Managed service providers with access to client systems
• Any vendor whose customers require third-party assurance

Typical Journey

Gap Assessment → Remediation → Type I Audit → Observation Period → Type II Audit → Annual Renewal
    (4-8 wk)      (8-16 wk)     (4-6 wk)       (6-12 mo)          (4-6 wk)       (ongoing)

Trust Service Criteria

SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is required for every SOC 2 report; the remaining four are optional and selected based on business need.

Security (Common Criteria CC1-CC9) — Required

The foundation of every SOC 2 report. Maps to COSO 2013 principles.

Availability (A1) — Optional

Select when: Customers depend on your uptime; you have SLAs; downtime causes direct business impact.

Confidentiality (C1) — Optional

Select when: You handle trade secrets, proprietary data, or contractually confidential information.

Processing Integrity (PI1) — Optional

Select when: Data accuracy is critical (financial processing, healthcare records, analytics platforms).

Privacy (P1-P8) — Optional

Select when: You process PII and customers expect privacy assurance (complements GDPR compliance).

Control Matrix Generation

A control matrix maps each TSC criterion to specific controls, owners, evidence, and testing procedures.

Matrix Structure

Control Naming Convention

{CATEGORY}-{NUMBER}
SEC-001 through SEC-NNN  → Security
AVL-001 through AVL-NNN  → Availability
CON-001 through CON-NNN  → Confidentiality
PRI-001 through PRI-NNN  → Processing Integrity
PRV-001 through PRV-NNN  → Privacy

Workflow

1. Select applicable TSC categories based on business needs
2. Run control_matrix_builder.py to generate the baseline matrix
3. Customize controls to match your actual environment
4. Assign owners and evidence requirements
5. Validate coverage — every selected TSC criterion must have at least one control

Gap Analysis Workflow

Phase 1: Current State Assessment

1. Document existing controls — inventory all security policies, procedures, and technical controls
2. Map to TSC — align existing controls to Trust Service Criteria
3. Collect evidence samples — gather proof that controls exist and operate
4. Interview control owners — verify understanding and execution

Phase 2: Gap Identification

Run gap_analyzer.py against your current controls to identify:

• Missing controls — TSC criteria with no corresponding control
• Partially implemented — Control exists but lacks evidence or consistency
• Design gaps — Control designed but does not adequately address the criteria
• Operating gaps (Type II only) — Control designed correctly but not operating effectively

Phase 3: Remediation Planning

For each gap, define:

Phase 4: Timeline Planning

Evidence Collection

Evidence Types by Control Category

Automation Opportunities

Continuous Monitoring

Move from point-in-time evidence collection to continuous compliance:

1. Automated evidence gathering — scripts that pull evidence on schedule
2. Control dashboards — real-time visibility into control status
3. Alert-based monitoring — notify when a control drifts out of compliance
4. Evidence repository — centralized, timestamped evidence storage

Audit Readiness Checklist