Understanding SOC 2 Audits

What is the purpose of SOC 2 audits, and who needs them?

The purpose of a SOC 2 audit is to evaluate the internal controls a company employs in securing data and information, and determine if they meet the minimum standard as outlined by the AICPA. With business activity increasingly supported by cloud environments, it’s essential that organizations take intentional steps to keep their customer’s data and information secure. 

While all SaaS companies operating in the cloud space can benefit from a SOC 2 audit, it is a must-have for startups attempting to grow their brand. Any prospective enterprise customer will want to see that the startup is SOC 2 certified, or at least going through the SOC 2 certification process. By not undergoing a SOC 2 audit, a SaaS startup can place itself at a competitive disadvantage and potentially lose business.   

Who performs SOC 2 audits?

Only a licensed CPA can perform a SOC 2 audit. Auditors will work with members of your organization to collect evidence of your internal controls, including IT and/or security team members. Further, as part of the audit, management will have to provide a formal assertion regarding the internal controls in place, and the auditor will either agree or disagree with that assertion when writing the SOC 2 report. 

How to prepare for a SOC 2 audit

A SOC 2 audit can be a long process that can take months. Completing a SOC 2 readiness assessment prior to kicking off the audit can help speed the process by locating gaps in controls or processes. You can prepare for an audit by performing external vulnerability testing, a gap analysis, and penetration testing.  

• An external vulnerability scan targets external IP addresses throughout your network, which, if exploited by bad actors, can serve as a backdoor into your internal network. 

• A gap analysis identifies gaps in your cybersecurity defenses and is performed by comparing your organization's security program to the SOC 2 framework. 

• A pen test (penetration test) simulates an attack on a network and can be used to find vulnerabilities before malicious actors do.

• Scanning your cloud environment with a tool like Snyk enables you to uncover configurations that might violate SOC 2 controls.

What is the SOC 2 audit process?

The SOC 2 audit process can be distilled into five steps: A gap analysis (pre-audit), scoping exercises, evidence gathering, an onsite visit, and SOC 2 report (post-audit). 

1. Gap analysis

As explained above, a gap analysis identifies gaps in your cybersecurity defenses and cloud infrastructure environment by comparing your organization's security program to an industry-standard security framework — in this case, SOC 2.

2. Scoping exercises

With your auditor, you’ll determine the scope of the audit. A SOC 2 audit assesses your information security management system in the context of up to five SOC 2 trust principles: security, availability, processing integrity, confidentiality, and privacy. Only the security principle is mandatory, but service organizations can choose any of the other four for further evaluation to demonstrate they are in compliance with that principle. 

Additionally, you will determine whether a SOC 2 Type 1 audit (which examines your internal controls at a certain point in time) or a SOC 2 Type 2 audit (which measures your controls across a length of time) is appropriate. 

3. Evidence gathering

You’ll be asked to submit evidence of your internal controls, policies, and procedures to your auditor. Compliance management software can automate a lot of document gathering and submission to expedite the process. Tools that assess the SOC 2 compliance posture of your cloud infrastructure environment can provide additional evidence.

4. Onsite visit

If required in the scope (and if your organization isn’t fully remote), your auditor may need to visit your location and perform a physical inspection of your environment. The auditor will attempt to gain an in-depth understanding of your organization’s controls, processes, and procedures. They’ll look to see how you lock down certain devices, and who can access sensitive areas where critical information might be stored. 

5. SOC 2 report

Following the examination, your auditor will deliver a SOC 2 report, which will contain an opinion surrounding the examined controls and will state whether the auditor agrees with management’s formal assertion. If the auditor determines the information security management system complies with the SOC 2 standard, organizations can use this certification to their advantage. 

SOC 2 audit checklist

It’s not uncommon for a SOC 2 audit to take many months to complete. But with proper preparation, you can expedite the process and obtain your SOC 2 certification a bit faster. Here’s a checklist you can use before kicking off an official audit.

1. Determine your SOC 2 audit scope. No one knows your information security management system better than you do; use this knowledge to determine whether a Type 1 or Type 2 audit is the better fit, and which, if any, of the optional trust service principles you’d like to target. 

2. Perform a readiness assessment. A readiness assessment is a trial run of a SOC 2 audit. While you can perform it yourself, engaging an auditor will be effective in helping identify any weaknesses in your internal controls, systems, and processes. They’ll also issue recommendations you can use to strengthen your cybersecurity posture. 

3. Perform a gap analysis and corrective measures. A gap analysis will include corrective measures you can use to close gaps in your cybersecurity defenses so you’ll pass your SOC 2 audit. These measures might include implementing new controls and training employees on them, generating and updating control records, and altering workflows to enhance information security. 

4. Perform a second readiness assessment. Now that you’ve identified and closed some of the gaps, it’s helpful to perform a second readiness assessment to ensure you’ve addressed all vulnerabilities. Remediate any remaining problems, and you’ll be ready to approach a CPA firm to kick off your official SOC 2 audit.

Though the above steps are important when preparing for your audit, SOC 2 preparation is an ongoing process — it shouldn’t stop after step four. Operationalizing the process will help your company with future audits and ensure that you’re continually SOC 2 compliant.  

How can Snyk help with SOC 2 audits?

Snyk uses a unified policy as code engine to help teams overcome cloud security and compliance challenges. The solution provides guardrails for security and compliance across major cloud providers to help teams adhere to all relevant policies — right out of the box. 

Additionally, Snyk Infrastructure as Code leverages cloud security automation so that you can automatically set up policies for SOC 2 compliance checks during infrastructure as code development and deployment.

SOC 2 audit FAQs