the whole job

SOC 2: the whole job, in order

Customers, mostly in sales questionnaires, ask service providers for a SOC 2 report. It is a licensed auditor's statement on your controls, so a report shows what the auditor tested, within the scope and the period it states. It does not show compliance with a law, and no EU regulation on this site requires it. This plan runs from the question of what the customer will accept to the next reporting period, in six stages.

last checked 2 November 2026

how to read this plan

SOC 2 is an attestation, so most steps decide scope and build controls that then have to run with evidence. The criteria are not public in full and were not read for this plan, which is why every step says practice and no criterion is cited: have your auditor confirm numbers and categories. The numbers on the map are the commonly published ones from the 2017 criteria, and AICPA lists exposure drafts of proposed 2027 criteria dated 26 October 2026, so ask your auditor how that proposal affects your period. Where a step also helps with a law such as GDPR, the step says so, and the basis stays practice. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

decide whether to get a report, and what for

Find out what the customer will accept, which report type and criteria categories you need and which service it covers.

  1. ask what the customer will accept

    Ask the customer who raised it whether a report is required or whether evidence you already hold would do. The answer may save you the year. Record it with the date.

    • owner board
    • decide and document
    what it produces
    a short note of what each customer asked for and what each would accept
    the proof it leaves
    the note, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. choose the report type and the categories

    There are five categories: security, availability, processing integrity, confidentiality and privacy. Security is in every report and the others are optional. Pick them with the customer, because they change the size of the work. Decide between a type I and a type II report with your auditor, since type II needs a period of evidence.

    • owner board
    • decide and document
    what it produces
    a decision on report type and categories, with the customer's reason
    the proof it leaves
    the decision and the customer's written answer

    basis working practice. No legal text sets this.

  3. name the service in scope and who answers for it

    Write down which service, systems and teams the report covers, and name one accountable owner and one operational lead. If the privacy category is in, the same owner should sit near your GDPR work.

    • owner board
    • decide and document
    what it produces
    a scope statement and a decision naming the owner and the lead
    the proof it leaves
    the statement and the minutes of the decision

    basis working practice. No legal text sets this.

you are done with this phase when you can show a decision with the customer's answer, the report type, the chosen categories and the service in scope.
02

check where you stand

Compare your controls with the criteria you chose and turn the differences into a plan.

  1. choose the audit firm and ask for the criteria

    A report comes from a licensed CPA firm under AICPA standards. Ask each candidate how it works, what it needs from you and which criteria edition it will use for your period. Get the answers in writing.

    • owner procurement
    • decide and document
    what it produces
    a chosen audit firm and its written answers on criteria and method
    the proof it leaves
    the answers and the engagement terms

    basis working practice. No legal text sets this.

  2. compare your controls with the criteria

    Go through the criteria for your categories with the people who run the systems, and mark which controls you have, which run only in part and which are missing. The work you did for laws such as NIS2 will cover a good part of it.

    • owner head of IT
    • prove and operate
    what it produces
    a gap list with the finding, the owner and the proof you already hold
    the proof it leaves
    the gap list, dated and signed by the operational lead

    basis working practice. No legal text sets this.

  3. order the gaps into one plan of work

    Put the gaps in the order in which they depend on each other, give each an owner and a date. A type II period cannot start until the controls run, so decide the date by which they must.

    • owner board
    • decide and document
    what it produces
    an ordered plan of work with owners and dates
    the proof it leaves
    the plan, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a gap list with an owner for each item, and an auditor chosen.
03

build the controls

Put the controls in place for the service in scope, and decide how each one leaves evidence.

  1. write the policies and the roles

    Write the short policies that your controls rest on, have management sign them and run a risk assessment for the service. Record who accepted which risk.

    • owner board
    • build and configure
    what it produces
    signed policies, a table of roles and a risk register
    the proof it leaves
    the policies with version and approval, and the register

    the work pagethe control: risk-register

    basis working practice. No legal text sets this.

  2. control who can get in

    Set up access by role with approval, remove access when people leave or change jobs, and review it on a fixed rhythm. Auditors test this by sampling, so each action needs a record.

    • owner head of IT
    • build and configure
    what it produces
    access rules, a joiner and leaver routine and a review record
    the proof it leaves
    the review records and the tickets for sampled changes

    the work pagethe control: access-reviews

    basis working practice. No legal text sets this.

  3. watch the systems and handle incidents

    Collect logs for the service in scope, decide who looks at them and when, and write the procedure for an incident, with roles and a record. The same routine serves NIS2 and GDPR incident duties, where they apply to you.

    • owner head of IT
    • build and configure
    what it produces
    a monitoring routine and an incident procedure with a log of events
    the proof it leaves
    the logs, the procedure and the incident records

    the work pagethe control: incident-management

    basis working practice. No legal text sets this.

  4. fix weaknesses and keep backups

    Scan for known weaknesses, set how fast each severity gets fixed and record exceptions. Back up what the service needs and test a restore, particularly if you chose the availability category.

    • owner head of IT
    • build and configure
    what it produces
    a patching routine and a restore test record
    the proof it leaves
    scan results, fix dates and the restore test

    the work pagethe control: vulnerability-management

    basis working practice. No legal text sets this.

  5. bring suppliers and people into scope

    Sort the suppliers that touch the service by what they can reach, ask the critical ones about their security and put terms in the contract. Train the people in scope and keep the record.

    • owner procurement
    • build and configure
    what it produces
    a supplier register with contract terms, and a training record
    the proof it leaves
    the register, the answers received and the attendance record

    the work pagethe control: supplier-management

    basis working practice. No legal text sets this.

you are done with this phase when you can show each control running, with a written description and a named owner.
04

run the controls through the observation period

For a type II report, keep every control running with evidence for the whole period.

  1. fix the period and its start date

    A type II report needs the controls running, with evidence, for the whole period, so the earliest date depends on when your controls started. Agree the period and the start with your auditor, and do not start before the controls run.

    • owner board
    • decide and document
    what it produces
    an agreed period and start date
    the proof it leaves
    the auditor's written confirmation

    basis working practice. No legal text sets this.

  2. collect evidence as the period runs

    Keep each control's evidence as it happens: the review records, tickets, logs and training lists. Collecting it at the end leaves gaps you cannot fill, because the auditor tests the whole period.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder organised by control and filled through the period
    the proof it leaves
    the folder, with each item dated

    basis working practice. No legal text sets this.

  3. fix a failed control and record what happened

    When a control fails or is skipped, fix it at once and record the date, the cause and the fix. Tell the auditor early, since a documented failure is easier to deal with than one found in testing.

    • owner head of IT
    • prove and operate
    what it produces
    an exception log with cause, fix and date
    the proof it leaves
    the log and the records of the fixes

    basis working practice. No legal text sets this.

you are done with this phase when you can show evidence for each control from every part of the period, and no unexplained gaps.
05

go through the audit and use the report

Give the auditor what it needs, read the opinion and use the report as written.

  1. answer the auditor and supply samples

    Give the auditor the evidence it asks for, name one person who handles requests, and answer in writing. Keep a log of what was sent and when.

    • owner everyone
    • prove and operate
    what it produces
    a request log and the evidence supplied
    the proof it leaves
    the log and the supplied files

    basis working practice. No legal text sets this.

  2. read the opinion and the exceptions

    Read the opinion and any noted exceptions before you send the report on. A qualified opinion or no report can cost a deal, so plan with the customer what to do if it comes to that.

    • owner legal or DPO
    • decide and document
    what it produces
    a reading of the opinion and a plan for any exception
    the proof it leaves
    the report and the plan

    basis working practice. No legal text sets this.

  3. say what the report covers when you share it

    State the service, the categories and the period as the report gives them, and share the report under the confidentiality terms that suit it. Do not describe it as compliance with GDPR or any other law.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the report covers, for sales and legal
    the proof it leaves
    the report and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show the report and a statement of what it covers, which you can give to customers.
06

keep it going for the next period

Keep the controls running without a break and plan the next report.

  1. plan the next period before the last one ends

    Agree the next period with the auditor so that it follows the last one, and decide whether the scope or the categories change. A break between periods leaves a stretch that no report covers.

    • owner board
    • decide and document
    what it produces
    a plan for the next period with its start date and scope
    the proof it leaves
    the plan and the auditor's confirmation

    basis working practice. No legal text sets this.

  2. ask about the proposed 2027 criteria

    AICPA lists exposure drafts of proposed 2027 criteria. Ask your auditor which criteria edition applies to each of your periods, and what changes if the proposal is adopted.

    • owner legal or DPO
    • decide and document
    what it produces
    a written answer on which criteria apply to which period
    the proof it leaves
    the auditor's answer, dated

    basis working practice. No legal text sets this.

  3. review the controls with management

    Once a year, show management the state of each control, the exceptions and the open gaps, and record what they decide. Keep the risk register and the supplier register current between periods.

    • owner board
    • prove and operate
    what it produces
    a yearly report to management
    the proof it leaves
    the report and the minutes

    basis working practice. No legal text sets this.

you are done with this phase when you can show controls running across the join of two periods, and a plan for the next report.

who carries what

The same steps, grouped by the person who has to act.

board

procurement

head of IT

everyone

legal or DPO

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask the customer who raised it what they need, then check whether evidence you already hold answers it.

    open the map