Planning SOC 2 Readiness: Scope, Evidence and Next Steps

What SOC 2 readiness actually means

A SOC 2 report is issued by an independent CPA firm after an examination performed under AICPA attestation standards. Readiness work is different: it is the preparation that happens before that examination, so the controls, evidence and ownership are in place when the auditor arrives. MarkKings Group provides readiness consulting. We do not issue SOC 2 reports or opinions, and no consultancy can. For the official description of SOC 2 examinations, see the AICPA guidance on SOC 2.

Step 1: Define the scope before anything else

Scope decisions drive cost, effort and timeline more than any other factor. Three questions matter most:

• Which Trust Services Criteria apply? Security (common criteria) is always included. Availability, Confidentiality, Processing Integrity and Privacy are added only when they are relevant to the commitments you make to customers.
• Which system is in scope? Name the product, the environments, the supporting infrastructure and the third parties that process customer data. Anything outside that boundary is out of scope and should be documented as such.
• Which locations, teams and processes support that system? Onboarding and offboarding, change management, incident response and vendor management usually all fall inside the boundary.

A narrow, accurate scope that reflects reality is far better than a broad scope you cannot evidence.

Step 2: Run a gap assessment against the criteria

A gap assessment maps each applicable criterion to the control you actually operate today, then records the difference. Useful output is specific: the control, the system that enforces it, the owner, the evidence it produces, and whether the gap is a missing control, an undocumented control, or a control that exists but produces no evidence.

The third category is the most common. Teams frequently do the right thing without leaving a record, and an examination assesses what can be evidenced.

Step 3: Assign control ownership

Every control needs a named owner who can explain it and produce its evidence. Ownership is where readiness programmes most often stall, because policies are written centrally while controls operate inside engineering, IT, HR and finance. Record the owner, the frequency of the activity, and where the record is stored.

Step 4: Understand the evidence period

This is the practical difference between the two report types:

• Type I reports on whether controls are suitably designed at a single point in time.
• Type II reports on whether controls were suitably designed and operated effectively throughout a period, commonly three to twelve months.

A Type II therefore requires history. If a quarterly access review only starts today, a twelve-month observation window cannot show four cycles of it. Many organisations begin with a Type I or a short initial Type II window, then extend the period in later cycles.

Step 5: Remediate, then let controls run

Remediation is the work between the gap assessment and the examination: implementing missing controls, documenting existing ones, fixing configuration, tightening access, formalising vendor review, and creating the artefacts each control produces. After remediation, controls need to operate long enough to generate the evidence the observation period requires.

Step 6: Coordinate with the auditor

The CPA firm is engaged separately and independently. Readiness support typically includes preparing the system description, organising the evidence requests, walking control owners through what they will be asked, and tracking open items. The auditor selects samples, performs tests and forms an opinion. A consultant cannot influence that opinion, and any promise otherwise should be treated as a warning sign.

What actually determines the timeline

There is no fixed number of days, and we do not promise one. Timelines are driven by:

• how much of the control environment already exists and is documented;
• how quickly control owners can be assigned and can act;
• the length of the observation period you and your customers need;
• the number and severity of gaps found, particularly those requiring engineering work;
• auditor availability and scheduling;
• how promptly evidence requests are answered during fieldwork.

Organisations with mature identity, change and monitoring practices move considerably faster than those starting from an undocumented environment.

A realistic sequence

1. Scope definition and applicability decisions.
2. Gap assessment against the applicable criteria.
3. Control ownership and remediation plan.
4. Remediation and policy work.
5. Observation period during which controls operate and produce evidence.
6. Auditor selection and examination fieldwork.
7. Report issued by the CPA firm, then a maintenance cycle for the next period.

Where MarkKings Group fits

We support scope definition, gap assessment, risk and control registers, policy development, evidence collection, vendor risk review and remediation tracking, and we help you coordinate with the CPA firm you appoint. We do not perform the examination and we do not issue certificates or attestations.

If you are planning a first SOC 2, or preparing for a period that has already been promised to a customer, tell us where you are and we will set out a realistic scope and sequence.