Blog · SOC 2 readiness · Problem 15 of 93
Your first SOC 2 audit is in three months. Find the gaps while you can fix them.
· 3 min read · By Case Jones
You signed with an audit firm and the date is on the calendar. You are the founder, CTO or the engineer who said yes to owning this, and you are not sure what the auditor will ask for.
What it costs to leave it
Gaps found during the audit become exceptions in the report, and buyers read those. Evidence you cannot produce is treated as work that did not happen. A rushed last month also pulls your best engineers off product at the worst time.
A three-month plan for a first SOC 2 audit
Spend the first month finding gaps, the second fixing them, and the third proving it. Here is what that looks like.
- 1
Weeks 1 and 2: agree the scope
Confirm with your auditor which systems, teams and trust services criteria are in scope. Security is always included, and availability or confidentiality are common additions. A smaller, clear scope is easier to pass and still useful to buyers.
- 2
Weeks 2 to 4: compare what you have with what they test
Ask the auditor for their request list or control list, or use the SOC 2 criteria directly. For each item, note whether you have a policy, whether you do the thing, and whether you can show a record. The third column is usually where the trouble is.
- 3
Month 2: write the missing policies and fix the practices
Write the policies you lack and get them approved by someone with authority. Then fix the practices that do not match, like turning on MFA everywhere or writing down the offboarding steps. Where a sensible policy and the practice differ, fix the practice.
- 4
Month 2 onward: record the repeating work as it happens
Access reviews, onboarding, offboarding, change approvals and backup tests all need a dated record. Set up a checklist for each and keep the output. For a Type 2, these records over the period are the audit.
- 5
Month 3: do a dry run
Pick ten requests from the auditor's list and try to answer them in under an hour each. Anything that takes longer needs a better home. Fix those, then collect everything in one place with clear names.
- 6
Before day one: name one contact
Give the auditor one person to work with and agree how requests will be sent and tracked. Slow replies stretch an audit out more than anything else.
Example
A gap list row that tells you what to do
Control: user access is removed when people leave. Policy: yes, access control policy section 4. Practice: yes, done by the CTO. Record: none. Fix: offboarding checklist with a sign-off and an export of remaining accounts, starting this week.
Or see what you are missing in one pass
In 93 Compliance, risk and requirement tests mark each requirement green, yellow or red against your policies and risks. The policy builder writes what is missing, and tests every document against SOC 2. Procedures turn into checklists that collect evidence each time they run, and every run's record is kept and not edited.
When the audit starts, you invite the auditor by email for the audit period. Their access is read-only, ends by itself after at most 120 days, and every visit is recorded. They get one audit package with an index page, a control matrix from requirement to policy to procedures to runs, every policy version in effect, the risk register and the evidence with SHA-256 fingerprints.
It is free. It does not certify you or promise an outcome. It makes the work easier to show.
- Requirements marked green, yellow or red
- Missing policies drafted and tested against SOC 2
- Checklists that keep evidence as work happens
- Read-only auditor access for the audit period
- One audit package with a control matrix
See what you're missing
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Is three months enough to get ready for SOC 2?
It can be for a Type 1 if the scope is small and your practices are mostly sound. For a Type 2, three months often gets you ready to start the observation period. Your auditor can tell you which you are aiming at.
What do auditors ask for most?
Approved policies, lists of who has access to what, records of access being granted and removed, change approvals, onboarding and training records, vendor reviews and incident records. Expect to show samples, like five new hires and their onboarding records.
Do we need a readiness assessment first?
Some audit firms offer one and it can help if you are unsure of scope. If you do one, keep it separate from the audit itself and use it to set your gap list.
What happens if the auditor finds a gap?
It is usually written up as an exception, with your response alongside it. One or two exceptions with clear fixes are common in first reports. Many exceptions in the same area are what worry buyers.