SOC2准备

---
name: soc2-prep
description: "When to activate: SOC 2, SOC2, trust service criteria, security audit, Type I, Type II, evidence collection, audit preparation, controls, AICPA, vendor security"
origin: zakr
metadata:
  namespace: zakr/devtools-pack
  version: 1.0.0
  category: business
  domain: compliance
  platforms: [claude-code, codex, gemini-cli, cursor, aider, windsurf]
---

# SOC 2 Preparation Guide

> **Disclaimer**: This is informational only and does not constitute legal or audit advice. Engage a licensed CPA firm for your SOC 2 examination.

## SOC 2 Overview

SOC 2 (Service Organization Control 2) is an auditing framework developed by AICPA. It evaluates controls at a service organization relevant to security, availability, processing integrity, confidentiality, and privacy of customer data.

### Type I vs Type II

| | Type I | Type II |
|--|--------|---------|
| **What it covers** | Controls are suitably designed at a point in time | Controls are suitably designed AND operating effectively over a period |
| **Time period** | Single date | Minimum 6 months (typically 12) |
| **Value** | Quick win, less expensive | Higher assurance, preferred by enterprise buyers |
| **Use case** | First audit, new program | Recurring annual audit |

**Recommendation**: Pursue Type II for enterprise sales. Type I is a stepping stone.

## Trust Service Criteria (TSC)

Only **Security (Common Criteria)** is mandatory. Others are optional add-ons.

### CC: Security (Common Criteria) — Required

Nine categories (CC1–CC9):

| Category | Focus |
|----------|-------|
| CC1 | Control environment (tone at top, governance, accountability) |
| CC2 | Communication and information |
| CC3 | Risk assessment |
| CC4 | Monitoring activities |
| CC5 | Control activities |
| CC6 | Logical and physical access controls |
| CC7 | System operations |
| CC8 | Change management |
| CC9 | Risk mitigation (vendor management, business continuity) |

### A: Availability (Optional)
- System availability for operation and use as agreed
- Performance monitoring, DR/BCP, capacity planning

### PI: Processing Integrity (Optional)
- System processes are complete, valid, accurate, timely, authorized
- Critical for financial or transaction-processing systems

### C: Confidentiality (Optional)
- Information designated confidential is protected as agreed
- Encryption, access controls, destruction procedures

### P: Privacy (Optional)
- Personal information is collected, used, retained, disclosed per privacy notice
- Aligns with AICPA Privacy Management Framework (similar to GDPR principles)

## Pre-Audit Readiness Assessment

### Phase 1: Scoping (Months -12 to -9)

- [ ] Define system description boundaries (what is in scope)
- [ ] Identify all components: infrastructure, software, people, data, procedures
- [ ] Choose TSC categories based on customer requirements
- [ ] Select audit firm (Big 4, regional CPA, SOC specialist)
- [ ] Perform gap assessment against TSC criteria

### Phase 2: Remediation (Months -9 to -3)

Fix gaps identified in assessment. Common gaps:

**Access Control**
- [ ] Centralized identity provider (Okta, Azure AD, Google Workspace)
- [ ] MFA enforced for all accounts (especially admin and remote access)
- [ ] Quarterly access reviews for all systems
- [ ] Privileged access management (PAM) for admin accounts
- [ ] Onboarding/offboarding procedures documented and enforced
- [ ] Principle of least privilege enforced

**Security Monitoring**
- [ ] SIEM or centralized log management
- [ ] Log retention minimum 12 months
- [ ] Intrusion detection/prevention (IDS/IPS)
- [ ] Vulnerability scanning (at least monthly)
- [ ] Penetration test (annual minimum)
- [ ] Incident response plan documented and tested

**Change Management**
- [ ] Change control policy documented
- [ ] Code review required before merge
- [ ] Separate environments (dev/staging/prod)
- [ ] Deployment approval workflow
- [ ] Emergency change procedure

**Risk Management**
- [ ] Formal risk assessment conducted annually
- [ ] Risk register maintained
- [ ] Risk treatment decisions documented

**Business Continuity**
- [ ] BCP and DRP documented
- [ ] Annual DR test with results documented
- [ ] RTO/RPO defined and tested
- [ ] Backup procedures tested and documented

**Vendor Management**
- [ ] Vendor inventory maintained
- [ ] Security assessments for critical vendors
- [ ] Contracts include security/confidentiality requirements
- [ ] Annual vendor review process

**HR Security**
- [ ] Background checks for employees with access to customer data
- [ ] Security awareness training (annual minimum, tracked)
- [ ] Acceptable use policy signed
- [ ] Confidentiality agreements signed

### Phase 3: Evidence Collection (Months -3 to 0)

Auditors will request evidence for every control. Organize by TSC category.

#### Evidence Types
- **Policies**: Written, approved, dated, version-controlled documents
- **Procedures**: Step-by-step operational documentation
- **Logs/Reports**: System-generated evidence (access logs, scan reports)
- **Screenshots**: Configuration screenshots with timestamps
- **Tickets**: Change tickets, incident tickets showing process followed

#### Evidence Collection Tools
- Google Drive / SharePoint folder per control
- Vanta, Drata, Secureframe, Tugboat Logic (automated evidence collection platforms)
- Notion/Confluence for policy documentation

#### Common Evidence Requests

| Control | Evidence |
|---------|----------|
| MFA enforcement | IdP configuration screenshot, policy document |
| Access reviews | Completed review spreadsheets with approvals |
| Vulnerability scanning | Scan reports for period (monthly) |
| Pen test | Report + remediation evidence |
| Security training | Completion certificates, LMS report |
| Incident response | IR policy + any incident tickets from period |
| Change management | Sample change tickets with approvals |
| Background checks | Vendor confirmation (not actual reports) |
| Encryption | Configuration evidence (TLS settings, disk encryption) |
| Backups | Backup policy + test restoration evidence |

## System Description

The auditor will publish a system description. Prepare this internally first:

```
Section 1: Overview of the system
Section 2: Components of the system
  a. Infrastructure
  b. Software
  c. People
  d. Procedures
  e. Data
Section 3: Boundaries of the system
Section 4: How the system captures and addresses risks
Section 5: Description of subservice organizations (vendors in scope)
Section 6: Complementary user entity controls (CUECs) — what customers must do
```

## Subservice Organizations

Any vendor that performs functions included in your scope must be addressed:
- **Carve-out method**: Exclude from scope, describe CUECs
- **Inclusive method**: Include in scope (requires their SOC 2 or direct assessment)

Common subservice orgs: AWS/GCP/Azure (infrastructure), Stripe (payments), Twilio (communications).

## Common Control Framework Mapping

Map your controls to multiple frameworks to reduce duplicate work:

| Your Control | SOC 2 CC | ISO 27001 Annex A | NIST CSF |
|-------------|----------|-------------------|----------|
| MFA | CC6.1 | A.9.4.2 | PR.AC-7 |
| Access review | CC6.2 | A.9.2.5 | PR.AC-1 |
| Vuln scanning | CC7.1 | A.12.6.1 | DE.CM-8 |
| Pen test | CC7.1 | A.18.2.3 | DE.CM-8 |
| Incident response | CC7.3 | A.16.1.5 | RS.RP-1 |

## Audit Timeline

```
Month -12:  Scoping, select auditor, gap assessment
Month -9:   Remediation begins
Month -6:   Observation period starts (Type II)
Month -3:   Evidence collection
Month -1:   Fieldwork / auditor interviews
Month 0:    Draft report review
Month +1:   Final report issued
```

## Post-Audit Maintenance

- [ ] Annual Type II renewal
- [ ] Continuous monitoring via compliance automation platform
- [ ] Quarterly access reviews (don't slip to annual)
- [ ] Monthly vulnerability scans
- [ ] Annual pen test
- [ ] Annual security training completion tracking
- [ ] Vendor review annual cycle
- [ ] Policy review annual cycle (document reviews in policy headers)

## Sharing the Report

- SOC 2 reports are confidential — share under NDA
- Prospects/customers request via security questionnaire process
- Some publish a "security page" confirming SOC 2 Type II status without sharing full report
- Trust portals (Vanta Trust, Drata Trust) allow controlled sharing