Aicpa Soc 2 Compliance Checklist

Standard Operating Procedure: AICPA SOC 2 Compliance Checklist

1. Document Control & Revision History

2. Executive Summary & Scope

Purpose: This SOP establishes the institutional rigor required to maintain compliance with AICPA SOC 2 Type II criteria. It facilitates the continuous evaluation of controls across the Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Scope: This procedure encompasses all internal infrastructure, cloud-native environments (AWS/Azure/GCP), HR onboarding/offboarding protocols, and third-party vendor management lifecycles. It applies to all personnel with access to production data environments.

3. Prerequisites & Tool Requirements

• Software Requirements: SIEM (e.g., Splunk, Datadog), MDM (e.g., Kandji, Jamf), Identity Provider (e.g., Okta, Azure AD), Compliance Automation Platform (e.g., Vanta, Drata).
• Access Requirements: Administrative/Read-only access to CSP consoles, Git repository access (IAM audit logs), and HRIS administrative access.
• Certifications: Lead Auditor or internal Compliance Officer must possess CISSP, CISA, or equivalent enterprise security certification.

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

Phase 1: Identity & Access Management (IAM) Audit

• Verify 100% MFA deployment across all SaaS and cloud production assets.
• Execute quarterly user access review (UAR); revoke access for terminated personnel within 24 hours of exit.
• Enforce Principle of Least Privilege (PoLP); audit standing admin privileges and rotate credentials.

Phase 2: Vulnerability Management & Infrastructure

• Confirm automated vulnerability scanning (Nessus/Qualys) frequency is set to weekly or trigger-based.
• Validate patch management cycle (Critical patches deployed within 48 hours; High within 14 days).
• Review cloud security group configurations for open ports (specifically 22, 3389, and 0.0.0.0/0 ingress).

Phase 3: Change Management

• Verify all production commits require peer review and associated Jira/Ticket reference.
• Ensure CI/CD pipeline triggers automated unit and security tests prior to merge.
• Retain change logs for a minimum of 12 months for auditor inspection.

Phase 4: Incident Response & Disaster Recovery

• Conduct annual tabletop simulation of a data breach; document gaps and remediate.
• Verify disaster recovery (DR) backup integrity through periodic restoration testing.

6. Quality Assurance & Verification Criteria

• Evidence Collection: All screenshots, logs, and configuration exports must be time-stamped and stored in a read-only repository.
• Thresholds: Zero "Critical" vulnerabilities permitted in production; 100% remediation of "High" vulnerabilities within the established SLA.
• Verification: Monthly spot-check of 10% of IAM accounts against HRIS records to ensure alignment.

7. Practical Troubleshooting Scenarios

Scenario A: Unauthorized Privilege Escalation Detected

• Action: Immediately quarantine the compromised identity within the IdP. Revoke all active sessions. Initiate an incident response log in the SIEM. Conduct a forensic review of the audit logs to determine the entry vector.

Scenario B: Failed Audit of Change Management Evidence

• Action: Identify missing ticket references for specific commits. Retroactively link commits if evidence of peer review exists in the VCS. If no peer review exists, flag as a "Compliance Exception," document the corrective measure (e.g., enforcing branch protection rules), and notify the CISO for risk acceptance.

Scenario C: Security Patch Compliance Drift

• Action: Identify the specific CI/CD pipeline blocking the patch. Halt deployment for the affected service. Manual remediation required for high-risk assets within 24 hours to prevent SOC 2 non-conformity.