SOC 2

SOC 2 is an attestation against the AICPA Trust Services Criteria. Security (the Common Criteria) is required; availability, processing integrity, confidentiality and privacy are optional.

Type I and Type II

• Type I tests control design at a point in time.
• Type II tests operating effectiveness over a period, usually 6 to 12 months.

Many teams do a Type I first, then start the Type II observation period immediately after.

Set up SOC 2 in cSquare

1. Create the program from the SOC 2 template and choose your criteria.
2. Define the system in scope: products, infrastructure, people and data.
3. Scope controls with the Control Applicability Wizard. Mark controls inherited from your cloud provider.
4. Connect evidence sources early: identity provider, cloud, code host and ticketing. Much Type II evidence is collected continuously.
5. Approve core policies: information security, access control, change management, incident response, vendor management, business continuity.
6. Upload prior reports to Document Intelligence to pre-populate findings.
7. Run a readiness review before booking the auditor.

Evidence auditors usually ask for

• User access reviews and onboarding/offboarding records.
• MFA enforcement and password settings.
• Change approvals and code review history.
• Logging and monitoring configuration and alerts.
• Vulnerability scans and remediation records.
• Policy approvals and employee acknowledgements.
• Vendor assessments for critical vendors.

Reuse

SOC 2 maps closely to ISO 27001. See Control mapping.