Soc 2 Compliance Checklist

Standard Operating Procedure: SOC 2 Compliance Readiness & Maintenance

1. Document Control & Revision History

2. Executive Summary & Scope

This SOP establishes the mandatory operational framework for achieving and maintaining SOC 2 Type II compliance. The scope encompasses the Trust Services Criteria (TSC) of Security, Availability, Processing Integrity, Confidentiality, and Privacy. This document is binding for all infrastructure, engineering, and human resources personnel managing systems that process, store, or transmit client data. It serves as the primary audit artifact for internal and external SOC 2 examinations.

3. Prerequisites & Tool Requirements

• Administrative Access: Root/Super-admin access to the cloud provider (AWS/GCP/Azure) and IdP (Okta/Google Workspace).
• Tooling:
  • GRC Platform (e.g., Vanta, Drata, or LogicGate).
  • SIEM (e.g., Datadog, Splunk, or Elastic Security).
  • MDM Solution (e.g., Kandji, Jamf, or Intune).
• Certification: Personnel must have completed annual Security Awareness Training (SAT) prior to system access.
• Documentation: Access to the current Information Security Policy (ISP) and the System Description document.

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

Phase I: Access Control & Identity Management

• Enforce MFA (TOTP or Hardware Key) on all corporate and production accounts.
• Perform quarterly user access reviews (UAR) for all production systems.
• Terminate access for offboarded employees within 24 hours (documented).

Phase II: Infrastructure & Vulnerability Management

• Ensure all production assets have automated patch management enabled.
• Execute quarterly vulnerability scans and document remediation timelines (SLA: < 30 days for Critical).
• Verify disk-at-rest and transit encryption protocols (AES-256/TLS 1.2+).

Phase III: Incident Response & Logging

• Verify centralized logging (Write-Once-Read-Many storage) for all production environments.
• Test the Incident Response Plan (IRP) via annual tabletop exercise.
• Confirm alert triggers for unauthorized access attempts are firing to the SOC/Security channel.

6. Quality Assurance & Verification Criteria

• Audit Checklist:
  • 100% of employees have signed the Information Security Policy.
  • 100% of production laptops are enrolled in MDM with full-disk encryption.
  • 100% of audit logs retained for a minimum of 365 days.
• Tolerance Thresholds: Zero tolerance for unauthenticated production access; zero tolerance for unencrypted PII at rest.
• Acceptance Benchmarks: Successful completion of "Clean Room" pre-audit assessment with no "Critical" or "High" findings remaining.

7. Practical Troubleshooting Scenarios

Scenario A: Unauthorized Access Detection

• Trigger: SIEM alerts for successful login from a non-company IP address.
• Protocol:
  1. Immediate account lockout for the target user.
  2. Force global session termination via IdP.
  3. Initiate Incident Response workflow; assess data exposure.
  4. Log the event in the Compliance GRC tool for the auditor.

Scenario B: MDM Enrollment Failure

• Trigger: Laptop found in production environment not reporting to MDM.
• Protocol:
  1. Revoke production environment API keys/SSO sessions for the specific machine.
  2. Quarantine the device from the VLAN/VPN.
  3. Mandatory re-imaging and enrollment.
  4. Document as a "Configuration Deviation" in the next quarterly audit report.