SOC 2 for Dummies – the A to Z Basics of SOC Reports & Audits

Thursday, 25 June 2020

1966 Hits

Looking for a SOC 2 for Dummies guide (and we’re not saying you’re dumb!), rather, you need a guide that cuts through the complexities of what a SOC 2 audit is?

If so, then welcome to the SOC 2 for Dummies pages, courtesy of NDB, North America’s leading provider of SOC 2 Type 1 and SOC 2 Type 2 audit assessments.

With that said, if you’re new to the world of SOC 2 compliance, take note of the following points for gaining a greater understanding of what it really takes to get ready – and become – SOC 2 compliant.

Know What the SOC 2 Framework is all About and What it Isn’t.
Find an Auditor who Truly Knows Your Industry.
Get Started with a Scoping & Readiness Assessment.
Determine which TSP’s are in Scope.
Understand that Remediation is Critical to becoming SOC 2 Compliant.
Remediate!
Be Aware that SOC 2 Compliance is NOT an Overnight Process.
It is an Annual Requirement (at least for most service organizations).

SOC 2 for Dummies – What you Need to Know

(1). Know What the SOC 2 Framework is all About and What it Isn’t.

So, what is SOC 2 Plainly speaking? SOC 2 is an assessment conducted on an organization’s internal control environment. So, what’s internal controls? It’s essentially an organization’s policies, procedures, and processes. SOC 2 has become one of the most widely accepted and well-known regulatory compliance assessments performed on service organizations.

So, what’s a service organization? It’s an organization that essentially offers services to another company. Think Software as a Service (SaaS) providers, e-commerce businesses, data centers – almost any organization that’s providing essential services to another business.

(2). Find an Auditor who Truly Knows Your Industry

Sounds easy enough, but truth be told, some industries really require the knowledge and expertise of a CPA who can understand your business from beginning to end. The more familiar a CPA firm is with your industry, the greater the efficiencies on the overall audit, no question about it, so keep this in mind. Call NDB today at 512-522-4943 (Austin), 214-272-0967 (Dallas), or at 713-331-5492 (Houston) to learn more about NDB’s SOC 2 services, or email us at This email address is being protected from spambots. You need JavaScript enabled to view it. to discuss your audit & compliance needs.

(3). Get Started with a Scoping & Readiness Assessment

One of the best activities to undertake for any SOC 2 report is a SOC 2 scoping & readiness assessment and for some vary obvious reasons. When performed correctly, a SOC 2 scoping & readiness assessment helps determine the actual audit scope, what items require remediation, what personal are to be involved in the audit, what third-parties are involved, and much more. Its’ an essential component of any SOC 2 audit process from beginning to end.

(4). Determine which TSP’s are in Scope

The following five (5) Trust Services Principles that can be included within the scope of a SOC 2 assessment:
• Security: The system is protected, both logically and physically, against unauthorized access.
• Availability: The system is available for operation and use as committed or agreed to.
• Processing Integrity: System processing is complete, accurate, timely, and authorized.
• Confidentiality: Information that is designated “confidential” is protected as committed or agreed.
• Privacy: Personal information is collected, used, retained, and disclosed in conformity with the commitments in the entity’s privacy notice and with the privacy principles put forth by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA).

So, which of these five TSP’s do you need to comply with? One, a few, all of them? Good question. Here’s some guidance on that topic.

(5). Understand that Remediation is Critical to becoming SOC 2 Compliant.

Every service organization – and we mean “every” – has tome type of remediation that has to be performed prior to the commencement of the actual audit. Perhaps its missing policies and procedures. Maybe an annual risk assessment has to be performed, or security awareness training needs to be conducted. Bottom line – every servicer organization should fully expect to undertake some form of remediation in the world of SOC 2 audits. How little or how much remediation is dependent upon one’s control environment and how mature it is or isn’t – that’s really what it comes down to.

NDB can assist with all aspects of remediation. What we’ve found over the years in working with hundreds of clients across North America is that documentation is by far the biggest area of remediation. Specifically, the need for information security policies and procedures. And’s it’s because of this that we’ve developed a SOC 2 policy packet – a complimentary set of policy templates available to all of NDB’s clients.

(6). Remediate!

There are three (3) main categories when it comes to remediation regarding SOC 2 audits, so let’s take a look at each of them.

Documentation Remediation: You’ll need to quickly come to an understanding of the profound importance of documentation – specifically – information security policies and procedures. Here’s a short list – and by no means inclusive – of all the policies and procedures needed for SOC 2 compliance:

Access Control
Data Backup and Recovery
Change Control
Incident Response
Data Loss Prevention
Various Usage policies
Contingency Planning

Authoring SOC 2 information security policies and procedures can be an incredibly tiring and taxing proposition, therefore, sourcing a set of high-quality, ready-to-go and use templates is so important. NDB offers a complimentary set of SOC 2 policy templates to all of our valued clients. If you want to save dozens of hours and thousands of dollars, then acquiring a set of information security policies is important. Use ours, they’re offered as part of NDB’s fixed fee pricing.

Technical Remediation: Perhaps password complexity rules need to be strengthened, firewall rules need to be re-configured, or backups need to be performed. These are just a few examples of the large list of technical remediation items that require attention for SOC 2 compliance. NDB can assist, providing as little or as much help as needed.

We have years of experience working with clients in all types of industries and environments, and we’re also well-versed on today’s cloud providers (Amazon AWS, Microsoft Azure, and Google GCP). With more and more organizations migrating to the cloud, it’s important to find a proven provider who understands how the cloud works in conjunction with SOC 2 audits and other regulatory compliance measures.

And even if you’re not in the cloud, NDB still offers proven services and solutions for service organizations operating with on-prem environments and those in data centers. Call NDB today at 512-522-4943 (Austin), 214-272-0967 (Dallas), or at 713-331-5492 (Houston) to learn more about NDB’s SOC 2 services, or email us at This email address is being protected from spambots. You need JavaScript enabled to view it. to discuss your audit & compliance needs.

(7). Be Aware that SOC 2 Compliance is NOT an Overnight Process

Hey, Rome wasn’t built in a day! Luckily, becoming SOC 2 compliant won’t take years, but it is a process, one that begins with a SOC 2 Scoping & Readiness assessment and culminates with the issuance of a SOC 2 Type 1 or a SOC 2 Type Service Auditor’s Report from a licensed CPA firm. With that said, expect to spend 2 to 3 weeks performing the readiness assessment, and then anywhere from a few weeks to a few months on remediation.

Remember, remediation is the big X factor as no one can really predict how many gaps and control deficiencies one has until the actual SOC 2 Scoping & Readiness assessment is performed. Call NDB today at 512-522-4943 (Austin), 214-272-0967 (Dallas), or at 713-331-5492 (Houston) to learn more about NDB’s SOC 2 services, or email us at This email address is being protected from spambots. You need JavaScript enabled to view it. to discuss your audit & compliance needs.

(8). It is an Annual Requirement

SOC 2 compliance is not a “one-and-done” deal, not at all. Once your organization has entered into the world of regulatory compliance – well – expect to stay there. And why? Because your customers demand and expect security controls that are functioning properly for securing their data. The world has changed dramatically in recent years – much of it because of technology.

Companies are sharing and exposing their data, IP, and other sensitive information more than ever before, and they want assurances of the safety and security of such information. SOC 2 is here to stay, so work with a firm that’s got a proven track record of providing fixed-fees, high-quality service, and is a household name throughout North America – that’s NDB.