What is SOC 2?
SOC 2 (System and Organisation Controls 2) is an auditing framework developed by the AICPA that evaluates how an organisation manages customer data. It is the de facto standard for SaaS companies and technology providers — enterprise buyers increasingly require a SOC 2 report before signing contracts.
Unlike ISO 27001, which certifies a management system, SOC 2 produces an auditor's report (attestation) on the design and operating effectiveness of your controls over a defined period.
SOC 2 Type I vs Type II
- Type I: Evaluates the design of your controls at a single point in time. Faster to achieve but provides less assurance.
- Type II: Evaluates the design and operating effectiveness of your controls over a period (typically 3 to 12 months). This is what most enterprise customers require.
If you are pursuing SOC 2 for the first time, many organisations start with a Type I to validate control design, then transition to a Type II audit once the controls have been operating for a sufficient period.
The Five Trust Service Criteria
SOC 2 is organised around five Trust Service Criteria (TSC). Security is always in scope; the others are optional depending on your service:
1. Security (Required)
Protection of information and systems against unauthorised access. This covers firewalls, access controls, intrusion detection, vulnerability management, and incident response. Every SOC 2 audit includes Security.
2. Availability
Systems are available for operation and use as committed. Relevant for organisations with uptime SLAs — covers disaster recovery, backups, capacity planning, and incident management.
3. Processing Integrity
System processing is complete, valid, accurate, and timely. Important for financial services, payment processors, and data pipelines where data accuracy is critical.
4. Confidentiality
Information designated as confidential is protected as committed. Covers encryption, access restrictions, data classification, and secure disposal of sensitive information.
5. Privacy
Personal information is collected, used, retained, and disposed of in line with the organisation's privacy notice. Relevant if you handle PII and want to demonstrate privacy controls to customers.
SOC 2 Readiness Checklist
Use this checklist to assess your readiness before engaging an auditor:
Governance and Policies
- Information security policy documented and approved by leadership
- Acceptable use policy communicated to all employees
- Incident response plan documented and tested
- Risk assessment performed and documented annually
- Vendor management policy with security requirements for third parties
Access Controls
- Role-based access control (RBAC) implemented across production systems
- Multi-factor authentication (MFA) enforced for all production access
- Access reviews performed quarterly — terminated employees removed promptly
- Principle of least privilege enforced and documented
- Privileged access logged and monitored
Change Management
- All code changes go through peer review before deployment
- Separate development, staging, and production environments
- Change requests documented with approval trails
- Rollback procedures defined and tested
Monitoring and Logging
- Centralised logging for production systems (SIEM or equivalent)
- Security events monitored with defined alert thresholds
- Logs retained for at least 12 months
- Uptime monitoring with alerting for critical services
Vulnerability Management
- Regular vulnerability scanning of infrastructure and applications
- Annual penetration testing by a qualified third party
- Critical and high vulnerabilities remediated within defined SLAs
- Patch management process documented and followed
Data Protection
- Data encrypted at rest and in transit (TLS 1.2+)
- Backup procedures documented with regular restore testing
- Data classification policy defining sensitivity levels
- Secure data disposal procedures for decommissioned assets
People and Training
- Security awareness training completed annually by all employees
- Background checks performed on new hires
- Security responsibilities defined in job descriptions and onboarding
Common SOC 2 Gaps
These are the issues we see most often when helping organisations prepare:
- Missing evidence: Controls exist but there is no evidence trail — screenshots, tickets, or logs — to prove they operate consistently
- Inconsistent access reviews: Reviews happen but not at the documented frequency, or terminated users linger in systems
- No formal incident response testing: The plan exists but has never been exercised through a tabletop or simulation
- Weak vendor management: No documented assessment of third-party security posture, especially for critical SaaS tools
- Incomplete change management: Some deployments bypass the review process or lack documented approval
How Zabryx Helps with SOC 2
Our GRC and Compliance team helps organisations design controls, build evidence, close gaps, and prepare for a smooth audit. We also deliver penetration testing and cloud security reviews — the technical assessments that SOC 2 auditors expect to see in your evidence package.
Preparing for SOC 2?
We help you design controls, collect evidence, and close gaps — so your audit runs smoothly the first time.
Talk to an Expert