Soc 2 Audit Checklist Pdf

Standard Operating Procedure: SOC 2 Audit Checklist

1. Document Control & Revision History

---

2. Executive Summary & Scope

This document defines the systemic requirements and procedural workflows necessary to achieve and maintain SOC 2 Type II compliance. The scope encompasses the Trust Services Criteria (TSC) of Security, Availability, Processing Integrity, Confidentiality, and Privacy. This procedure is mandatory for all personnel involved in the management of cloud infrastructure, data handling, and internal security controls. Compliance with this SOP is subject to audit by external independent accounting firms.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Administrative access to production environments (AWS/Azure/GCP), Identity Provider (IdP) (Okta/JumpCloud), and MDM (Jamf/Kandji).
• Software Dependencies:
  • GRC Platform (e.g., Vanta, Drata, or LogicGate).
  • SIEM/Log Aggregation Tool (e.g., Datadog, Splunk, or ELK).
  • Endpoint Detection and Response (EDR) agent (e.g., CrowdStrike).
• Documentation: Current Information Security Policy (ISP), Employee Handbook, and System Architecture Diagrams.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase 1: Preparation & Evidence Gathering

• Verify that all production assets are inventoried in the GRC platform.
• Confirm EDR is deployed on 100% of managed workstations.
• Conduct a gap analysis against the current SOC 2 Trust Services Criteria.
• Collect evidence of user access reviews performed within the last 90 days.

Phase 2: Control Testing

• Validate that Multi-Factor Authentication (MFA) is enforced globally via IdP.
• Review access logs for non-production environments to ensure segregation of duties.
• Confirm that termination of access occurs within 24 hours of employee offboarding.
• Verify that encryption at rest and in transit is enabled across all storage buckets and databases.

Phase 3: Final Review & Submission

• Audit the change management tickets for the last 6 months (ensure peer review/approval).
• Perform a "dry run" of the auditor's request list with internal stakeholders.
• Archive all supporting documentation in a read-only, encrypted repository.

---

6. Quality Assurance & Verification Criteria

• Success Threshold: 100% of critical controls must show zero exceptions during the audit period.
• Verification Benchmark: All evidence files must be time-stamped and signed by the data owner.
• Tolerance: Zero tolerance for non-compliance regarding MFA enforcement or administrative access without documented approval.
• QA Checklist:
  • Does the evidence directly correlate to the specific TSC criteria?
  • Is the evidence protected from unauthorized alteration?
  • Are screenshots captured with clear timestamps and machine IDs?

---

7. Practical Troubleshooting Scenarios

Scenario A: Missing Evidence for Historical Change Management

• Failure: A production deployment occurred without a documented Jira ticket/approval.
• Corrective Action: Immediate retrospective risk assessment. Document the change post-hoc, obtain sign-off from the Lead Engineer and CISO, and implement a "hard-stop" gate in the CI/CD pipeline to prevent future unauthorized deployments.

Scenario B: MDM De-synchronization

• Failure: EDR agent is missing from 5% of workstations due to OS incompatibility.
• Corrective Action: Isolate affected devices from the production network immediately. Re-image the devices or upgrade the EDR agent version. Document the incident in the Security Incident Log as an exception until remediation is confirmed.

Scenario C: Unauthorized Administrative Access

• Failure: A developer retained Admin access after moving to a non-technical role.
• Corrective Action: Revoke access immediately. Perform a forensic review of the user’s logs for the period of unauthorized access. Report finding to the Compliance Committee and update the offboarding/transfer checklist.