Plans · Operations

Get ready for a SOC 2 audit

16 weeks · 5 phases · 32 tasks · 4 milestones · 5 risks

For a small company whose customers have started asking for a SOC 2 report and who has no compliance team. The weeks run from scoping and a gap assessment through writing policies and fixing controls to collecting evidence and handing over to an auditor. Adapt the scope to the services customers actually rely on, and decide early whether you're aiming for a Type I report first or going straight to a Type II observation period.

Open this in Harbor

Makes it a program in your harbor, dated from today.

Milestones

Week 4Scope set and auditor signed
Week 8Policies approved
Week 12Controls in place
Week 16Fieldwork complete

The plan, phase by phase

1. Scope and choose an auditor

Weeks 1 to 4. Decide what the report covers and who will issue it.

Week 1Name an owner for the auditOne person who chases evidence and talks to the auditor. It is a big part of their job for these months.
Week 1List the systems and services in scopeStart from the product customers buy and the infrastructure, people and vendors it depends on.
Week 2Pick the Trust Services Criteria to includeSecurity is required. Add availability, confidentiality, processing integrity or privacy only if customers ask for them.
Week 2Decide between a Type I and a Type II reportType I looks at control design on one date. Type II tests that controls ran over an observation period, so it takes longer.
Week 3Shortlist and interview audit firmsSOC 2 reports are issued by licensed CPA firms. Ask about their experience with companies your size, their timeline and their fee.
Week 4Sign the engagement letter with the auditor

2. Gap assessment

Weeks 3 to 5. Find out which controls exist, which are informal and which are missing.

Week 3Map current practices against the criteriaA spreadsheet with one row per control, its owner, and where the evidence would come from is enough.
Week 4Run a formal risk assessment and record itList threats to the in-scope systems, rate them, and note the control that answers each.
Week 4Inventory vendors that touch customer data
Week 5Agree the list of gaps and who fixes each oneEvery gap gets an owner and a week. Unowned gaps are the ones still open at fieldwork.

3. Policies

Weeks 5 to 8. Write down the rules the company already follows, or should.

Week 5Draft the information security policyKeep it to what you actually do. The auditor tests against what the policy says.
Week 6Draft access control and offboarding policiesInclude how fast access is removed when someone leaves, and make sure you can meet it.
Week 6Draft change management and code review policies
Week 7Write the incident response plan
Week 7Write the business continuity and backup plan
Week 8Get policies approved and acknowledged by staffKeep the signed acknowledgments: they are evidence.

4. Fix the controls

Weeks 6 to 12. Close the gaps so each control runs the same way every time.

Week 6Turn on multi-factor authentication everywhere in scope
Week 8Run the first user access reviewCheck every account in every in-scope system against the staff list and remove what shouldn't be there.
Week 8Require reviews before changes reach production
Week 9Set up logging and alerting on production systemsDecide who reads the alerts and keep a record of what they did about them.
Week 10Test a restore from backup and record the result
Week 10Run security awareness training for all staff
Week 11Collect security reports from key vendorsAsk for their own SOC 2 reports or equivalent and note how you reviewed them.
Week 11Run an incident response tabletop exercise
Week 12Arrange a penetration test and fix what it finds

5. Evidence and audit

Weeks 12 to 16. Gather proof that the controls run, then support the auditor.

Week 12Build the evidence folder, one section per controlScreenshots, exports and tickets, each dated and labeled with the control it supports.
Week 13Write the system description
Week 14Do an internal readiness review against the evidence
Week 14Fix anything the readiness review turned up
Week 15Support auditor fieldwork and answer requestsAnswer within a day where you can. Slow replies are the usual reason fieldwork drags.
Week 16Review the draft report and management response
Week 16Schedule the recurring controls for the next year

What usually goes wrong

Scope grows too wide
Every extra system, criterion or team adds controls to build and evidence to collect.
What helps: Scope to the product customers are asking about and the infrastructure behind it. Add more in a later report.
Likelihood 3 of 5 · impact 4 of 5
Policies describe a company you aren't
Copied templates promise controls nobody runs, and the auditor tests against what is written.
What helps: Edit every template down to what you do now or will do by fieldwork. Delete what you won't do.
Likelihood 4 of 5 · impact 4 of 5
Evidence is collected at the last minute
Controls that ran months ago leave no trace if nobody saved the record at the time.
What helps: Save evidence as each control runs, into the folder for that control. Check the folder every two weeks.
Likelihood 4 of 5 · impact 3 of 5
The owner has no time for it
Audit work loses to product work every week unless someone is protected for it.
What helps: Agree up front how much of the owner's week this takes and what they stop doing. Review it at each milestone.
Likelihood 3 of 5 · impact 4 of 5
Engineering changes break controls mid-period
A new system or a skipped review during the observation period shows up as an exception.
What helps: Tell the engineering team which controls apply to them and add a check to the change process for new systems.
Likelihood 3 of 5 · impact 3 of 5

Using it

Copy what fits and cut what doesn’t: no real project matches a template. In Harbor the plan becomes a program with these milestones, one project holding every task with its due date, and these risks in the register, all yours until you hand them out. The first phase starts in To do and the rest wait in the backlog.

Open this in Harbor

More plans

See every plan