The Soc 2 Compliance Checklist

Standard Operating Procedure: SOC 2 Compliance Checklist

1. Document Control & Revision History

2. Executive Summary & Scope

This SOP establishes the operational framework for maintaining SOC 2 Type II compliance. The scope encompasses the Trust Services Criteria (TSC) of Security, Availability, Processing Integrity, Confidentiality, and Privacy. This document applies to all organizational infrastructure, internal personnel, and third-party vendors accessing sensitive customer data. Compliance is mandatory for maintaining the trust services status and mitigating enterprise risk regarding data exfiltration or unauthorized system access.

3. Prerequisites & Tool Requirements

• Access Requirements: Administrative access to Identity Provider (IdP) (e.g., Okta/Azure AD), Cloud Service Provider (AWS/GCP/Azure) root accounts, and MDM solutions.
• Documentation: Current Asset Inventory (CMDB), System Architecture Diagrams, and Data Flow Diagrams.
• Tools:
  • GRC Platform: Vanta, Drata, or LogicGate (for continuous monitoring).
  • SIEM/Logging: Splunk or Datadog for automated audit trail generation.
  • Vulnerability Scanner: Tenable or Qualys.
• Certifications: Personnel involved must hold current Security Awareness Training certification (refreshed annually).

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

Phase 1: Security Controls Implementation

• Implement Multi-Factor Authentication (MFA) across all production environments and IdP portals.
• Enforce Principle of Least Privilege (PoLP) via periodic Access Control Reviews (ACR).
• Deploy endpoint detection and response (EDR) on all corporate-issued assets.

Phase 2: Monitoring and Logging

• Configure centralized log aggregation for all system activities.
• Enable automated alerts for anomalous login attempts or unauthorized configuration changes.
• Define and test automated incident response workflows.

Phase 3: Risk Management and Assessment

• Conduct semi-annual penetration testing by a certified third party.
• Perform internal risk assessments covering physical, logical, and environmental threats.
• Validate vendor risk management assessments for all critical sub-service organizations.

Phase 4: Audit Readiness

• Gather evidence artifacts (screenshots, exported logs, policy signatures) into the GRC platform.
• Conduct a dry-run internal audit prior to the external engagement.
• Perform a final sanity check of evidence logs for non-conformities.

6. Quality Assurance & Verification Criteria

• Audit Checklist:
  • 100% of inactive accounts disabled within 24 hours of employee offboarding.
  • 100% of production changes linked to approved JIRA tickets.
  • Vulnerability scan results show 0 high/critical vulnerabilities older than 30 days.
• Tolerance Thresholds: Zero tolerance for credential sharing; zero tolerance for unencrypted sensitive data at rest.
• Acceptance Benchmarks: Successful verification of the "Evidence Gold Standard" (timely, complete, and immutable audit logs).

7. Practical Troubleshooting Scenarios

Scenario 1: Audit evidence is missing or logs have been purged.

• Protocol: Immediately trigger the "Incident Response: Data Integrity" process. Identify the gap in the logging retention policy. Escalate to the CISO, document the root cause, and implement a "compensating control" (e.g., manual snapshot verification) until automated logging is restored and verified.

Scenario 2: Critical vulnerability discovered 5 days before final audit.

• Protocol: Categorize the vulnerability via the Vulnerability Management Policy. If it cannot be remediated within 24 hours, apply a "Virtual Patch" (e.g., WAF rule or network isolation) to mitigate risk. Document the mitigation and the remediation timeline in the GRC platform to provide to the external auditor.

Scenario 3: Unapproved software detected on a developer workstation.

• Protocol: Quarantine the endpoint via MDM immediately. Wipe corporate data if necessary. Conduct a forensic review to determine if exfiltration occurred. Re-image the workstation and enforce the Approved Software List via the endpoint management policy.