When você're prepping o seu primeiro SOC 2 auditoria, mapear cada Trust Service Criteria na matriz de controlos você can entregar para o auditor. — Claude Skill

SOC 2 conformidade

SOC 2 Type I e Type II conformidade preparation para SaaS companies. Covers Trust Service Criteria mapping, matriz de controlos generation, evidência collection, lacuna analysis, e auditoria readiness assessment.

Table de Contents

• Overview
• Trust Service Criteria
• matriz de controlos Generation
• lacuna Analysis workflow
• evidência Collection
• auditoria Readiness checklist
• fornecedor Management
• Continuous conformidade
• Anti-Patterns
• Tools
• References
• Cross-References

Overview

What Is SOC 2?

SOC 2 (System e Organization Controls 2) is an auditing framework developed by o AICPA that evaluates how a service organization manages cliente dados. It applies para qualquer technology company that stores, processos, ou transmits cliente information — primarily SaaS, cloud infrastructure, e managed service providers.

Type I vs Type II

Who precisa de SOC 2?

• SaaS companies selling para enterprise clientes
• Cloud infrastructure providers handling cliente workloads
• dados processors managing PII, PHI, ou financial dados
• Managed service providers com access para cliente systems
• qualquer fornecedor whose clientes require third-party assurance

Typical Journey

lacuna Assessment → Remediation → Type I auditoria → Observation Period → Type II auditoria → Annual Renewal
(4-8 wk) (8-16 wk) (4-6 wk) (6-12 mo) (4-6 wk) (ongoing)

Trust Service Criteria

SOC 2 is organized around five Trust Service Criteria (TSC) categories. Security is obrigatório para cada SOC 2 relatório; o remaining four are opcional e selected based on business precisar de.

Security (Common Criteria CC1-CC9) — obrigatório

o foundation de cada SOC 2 relatório. mapeia para COSO 2013 principles.

Availability (A1) — opcional

Select when: clientes depend on o seu uptime; você have SLAs; downtime causes direct impacto de negócio.

Confidentiality (C1) — opcional

Select when: você handle trade secrets, proprietary dados, ou contractually confidential information.

Processing Integrity (PI1) — opcional

Select when: dados precisão is critical (financial processing, healthcare records, analytics platforms).

Privacy (P1-P8) — opcional

Select when: você processo PII e clientes expect privacy assurance (complements GDPR conformidade).

matriz de controlos Generation

A matriz de controlos mapeia each TSC criterion para specific controls, responsáveis, evidência, e testing procedures.

Matrix Structure

Control Naming Convention

{CATEGORY}-{NUMBER}
SEC-001 through SEC-NNN → Security
AVL-001 through AVL-NNN → Availability
CON-001 through CON-NNN → Confidentiality
PRI-001 through PRI-NNN → Processing Integrity
PRV-001 through PRV-NNN → Privacy

workflow

1. Select applicable TSC categories based on business precisa de
2. Run ¤KEEP0¤ para gerar o baseline matrix
3. Customize controls para match o seu actual environment
4. atribuir responsáveis e evidência requirements
5. validar cobertura — cada selected TSC criterion devem have at least one control

lacuna Analysis workflow

Phase 1: atual declarar Assessment

1. Document existing controls — inventário todos security políticas, procedures, e technical controls
2. mapear para TSC — alinhar existing controls para Trust Service Criteria
3. Collect evidência samples — gather proof that controls exist e operate
4. Interview control responsáveis — verify understanding e execution

Phase 2: lacuna Identification

Run ¤KEEP0¤ against o seu atual controls para identify:

• em falta controls — TSC criteria com no corresponding control
• Partially implemented — Control exists but lacks evidência ou consistency
• Design lacunas — Control designed but does não adequately address o criteria
• Operating lacunas (Type II only) — Control designed correctly but não operating effectively

Phase 3: Remediation Planning

para each lacuna, define:

Phase 4: Timeline Planning

evidência Collection

evidência Types by Control Category

Automation oportunidades

Continuous Monitoring

Move a partir de point-in-time evidência collection para continuous conformidade:

1. automatizado evidência gathering — scripts that pull evidência on schedule
2. Control dashboards — real-time visibility em control status
3. Alert-based monitoring — notify when a control drifts out de conformidade
4. evidência repository — centralized, timestamped evidência storage

auditoria Readiness checklist

Pre-auditoria Preparation (4-6 Weeks antes)

• todos controls documented com descriptions, responsáveis, e frequencies
• evidência collected para o entire observation period (Type II)
• matriz de controlos reviewed e lacunas remediated
• políticas signed e distributed dentro do último 12 months
• Access revê completed dentro do obrigatório frequency
• Vulnerability scans atual (no critical/high unpatched > SLA)
• incidente resposta plano tested dentro do último 12 months
• fornecedor risco assessments atual para todos subservice organizations
• DR/BCP tested e documented dentro do último 12 months
• Employee security training completed para todos staff

Readiness Scoring

Common auditoria Findings

fornecedor Management

Third-Party risco Assessment

cada fornecedor that accesses, stores, ou processos cliente dados devem be assessed:

1. fornecedor inventário — maintain a register de todos service providers
2. risco classification — categorize fornecedores by dados access level
3. Due diligence — collect SOC 2 relatórios, security questionnaires, certifications
4. Contractual protections — ensure DPAs, security requirements, breach notification cláusulas
5. Ongoing monitoring — annual reassessment, continuous news monitoring

fornecedor risco Tiers

Subservice Organizations

When o seu SOC 2 relatório relies on controls at a subservice organization (e.g., AWS, GCP, Azure):

• Inclusive method — o seu relatório covers o subservice org's controls (requires their cooperation)
• Carve-out method — o seu relatório excludes their controls but references their SOC 2 relatório
• Most companies usar carve-out e incluir complementary utilizador entity controls (CUECs)

Continuous conformidade

a partir de Point-in-Time para Continuous

Implementation Steps

1. Automate evidência gathering — cron jobs, API integrations, IaC snapshots
2. criar control dashboards — aggregate control status na single view
3. Configure drift alerts — notify when controls fall out de conformidade
4. Establish rever cadence — semanal control responsável verificar-ins, mensal steering
5. Maintain evidência repository — centralized, timestamped, auditor-accessible

Annual Re-Assessment Cycle

Anti-Patterns

Tools

matriz de controlos Builder

gera a SOC 2 matriz de controlos a partir de selected TSC categories.

# gerar full security matrix in markdown
python scripts/control_matrix_builder.py --categories security --format md

# gerar matrix para multiple categories as JSON
python scripts/control_matrix_builder.py --categories security,availability,confidentiality --format json

# todos categories, CSV output
python scripts/control_matrix_builder.py --categories security,availability,confidentiality,processing-integrity,privacy --format csv

evidência Tracker

Tracks evidência collection status per control.

# verificar evidência status a partir da matriz de controlos
python scripts/evidence_tracker.py --matrix controls.json --status

# JSON output para integration
python scripts/evidence_tracker.py --matrix controls.json --status --json

lacuna Analyzer

Analyzes atual controls against SOC 2 requirements e identifies lacunas.

# Type I lacuna analysis
python scripts/gap_analyzer.py --controls current_controls.json --type type1

# Type II lacuna analysis (inclui operating effectiveness)
python scripts/gap_analyzer.py --controls current_controls.json --type type2 --json

References

• Trust Service Criteria Reference — todos 5 TSC categories com sub-criteria, control objetivos, e evidência examples
• evidência Collection Guide — evidência types per control, automation tools, documentation requirements
• Type I vs Type II Comparison — Detailed comparison, timeline, cost analysis, e upgrade path

Cross-References

• gdpr-dsgvo-expert — SOC 2 Privacy criteria overlaps significantly com GDPR requirements; usar together when processing EU personal dados
• information-security-manager-iso27001 — ISO 27001 Annex A controls mapear closely para SOC 2 Security criteria; organizations pursuing both can share evidência
• isms-auditoria-expert — auditoria methodology e finding management patterns transfer directly para SOC 2 auditoria preparation