SaaS and cloud companies
Prepare systems, engineering processes, access controls, cloud configurations, vendors, logging, backups and customer-data safeguards.
SOC 2 Readiness • Consulting • Evidence Preparation
SOC 2 Compliance Readiness Services & Sample Report
Prepare your company before the formal CPA audit process with a CISO-led readiness review, control mapping, policy documentation, evidence organization, vendor review, risk assessment and remediation roadmap.
OC Security Audit helps SaaS companies, cloud providers, MSPs, technology firms and professional services teams in Orange County and Southern California get SOC 2 ready with practical security and compliance guidance.
25+Years IT, cybersecurity, audit and compliance experience
58Readiness checklist rows preserved in the workbook
I/IIType I and Type II readiness preparation
SoCalOrange County, Irvine, LA County and Southern California focus
Our Role
We prepare your company before the SOC 2 audit.
OC Security Audit provides SOC 2 readiness, consulting, gap assessment, control mapping, documentation, evidence preparation, risk assessment, vendor review, remediation support and audit preparation.
The official SOC 2 attestation report is issued by an independent licensed CPA firm. Our work helps your organization reduce surprises, organize evidence, close security gaps and prepare for the next phase.
Gap assessmentControl mappingPolicy documentationEvidence preparationVendor reviewRemediation roadmap
Who Needs SOC 2 Readiness
SOC 2 readiness built around your business, systems, customers and risk.
SOC 2 is often requested by enterprise customers, procurement teams, investors and business partners. If your company stores, processes, transmits, manages or protects customer information, you may need to show that your controls are designed, documented and operating in a repeatable way.
MSPs and service providers
Show customers that security operations, change management, incident response and vendor risk are governed and repeatable.
Professional services firms
Build readiness around confidential client data, Microsoft 365, endpoint security, access reviews, policies and evidence.
Process
Our SOC 2 readiness process moves from uncertainty to evidence.
Discovery and scoping
Identify in-scope systems, applications, services, data, users, vendors, locations, cloud platforms and business commitments.
Gap assessment
Compare current security program, policies, procedures, technical controls and documentation against readiness expectations.
Control mapping
Map controls for access, risk, change, vendors, incident response, backup, logging, vulnerability management, HR and governance.
Evidence preparation
Organize screenshots, tickets, logs, approvals, reports, access reviews, vendor reviews, risk records and policy approvals.
Risk and vendor review
Document the risk register, identify critical third-party vendors and prioritize remediation around business impact.
Policy documentation
Create or improve the security, access, vendor, change, incident, backup, risk and training policies needed for readiness.
Remediation support
Help IT and leadership close control gaps, improve configurations and strengthen repeatable operating procedures.
Final readiness review
Confirm scope, policies, ownership, risks, vendor reviews, evidence and open issues are organized before the formal audit process.
Trust Services Criteria
Readiness across the SOC 2 criteria that matter to your customers.
Security is normally central to SOC 2. Depending on your business, additional areas such as availability, confidentiality, processing integrity and privacy may also need to be considered.
Security
Access control, MFA, monitoring, vulnerability management, incident response and protection against unauthorized access.
Availability
Backup, recovery, business continuity, disaster recovery, capacity and service availability readiness.
Confidentiality
Data protection, encryption, access restriction, secure handling and confidentiality procedures.
Processing Integrity
Change control, processing accuracy, system procedures and operational consistency.
Privacy
Privacy procedures, data handling, notice, consent, retention and policy alignment where applicable.
Deliverables
Clear outputs leadership, IT teams and auditors can use.
Our consulting work is designed to produce practical outputs, not vague recommendations. The deliverables help leadership understand risk and help IT teams prepare repeatable evidence.
Readiness report
Executive summary, gap analysis, risk-rated findings and readiness roadmap.
Control matrix
Control mapping, ownership, readiness status and priority recommendations.
Policy package
Security, access, vendor risk, incident response, change, backup, BCDR, risk and training documentation.
Evidence tracker
Evidence request list, repository structure, screenshots, tickets, logs, approvals and review records.
Readiness Workbook
SOC 2 Readiness Control Matrix
This preserved 58-row matrix keeps the original page's spreadsheet-style checklist, with an internal scroll area, sticky header row and sticky first column so the page remains usable on desktop and mobile.
| Control ID | SOC 2 Area / TSC | Requirement / Criterion | Readiness Checklist Question | Control / Process to Investigate | Evidence to Prepare | Risk Assessment Focus | Business Impact if Gap Exists | Primary Owner | Systems / Scope | Readiness Status | Priority | OC Security Audit Consulting Support |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RD-01 | SOC 2 Readiness Program | Discovery & business context | Have the business objectives, services, customers, data types, and SOC 2 drivers been documented? | Interview leadership, IT, security, operations, HR, engineering, and application owners. | Discovery notes, service descriptions, org chart, customer requirements, business objectives. | Incomplete understanding of system boundaries and commitments. | Incorrect scope, wasted effort, missed controls, audit delay. | CISO / Executive Sponsor | Company-wide / in-scope service | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| RD-02 | SOC 2 Readiness Program | SOC 2 scope definition | Are systems, applications, locations, vendors, cloud platforms, data flows, and control owners clearly in scope? | Define in-scope products, infrastructure, applications, data stores, vendors, people, and processes. | Scope memo, system inventory, network/cloud diagram, data flow diagram, owner matrix. | Unclear scope or excluded dependencies. | Auditor questions, control gaps, incomplete evidence. | CISO / IT Manager | In-scope environment | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| RD-03 | SOC 2 Readiness Program | Trust Services Criteria selection | Has the company selected Security plus any relevant Availability, Confidentiality, Processing Integrity, or Privacy criteria? | Match criteria to customer contracts, service commitments, data sensitivity, uptime commitments, and business model. | Trust category recommendation, scope decision log, management approval. | Wrong criteria selection or over/under-scoping. | Higher audit burden, customer rejection, incomplete assurance. | Executive Sponsor / Compliance Lead | SOC 2 report scope | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| RD-04 | SOC 2 Readiness Program | Readiness gap assessment | Has a pre-audit gap assessment been performed before engaging the formal audit process? | Assess governance, access, operations, change, risk, vendors, security controls, and evidence maturity. | Gap report, risk-rated findings, remediation tracker. | Unknown weaknesses remain unresolved. | Audit delays, costly remediation, customer confidence issues. | CISO / Compliance Lead | All in-scope areas | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| RD-05 | SOC 2 Readiness Program | Evidence repository | Is there a structured, controlled evidence repository for policies, screenshots, tickets, reports, logs, and approvals? | Create folder structure, naming standards, evidence owner assignments, collection frequency, and retention approach. | Evidence tracker, repository index, sample evidence folders. | Missing or inconsistent audit evidence. | Controls may appear undocumented or not operating. | Compliance Lead / IT Manager | Evidence management | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| RD-06 | SOC 2 Readiness Program | Management readiness reporting | Does leadership receive clear status on readiness, risk, blockers, remediation, and open evidence? | Build executive dashboards, weekly milestone reports, control closure summaries, and decision logs. | Executive summary, readiness dashboard, meeting minutes. | Leadership blind spots and delayed decisions. | Readiness project stalls or risks remain accepted informally. | Executive Sponsor / CISO | Governance | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC1.1 | Security / Common Criteria | Control Environment: Integrity and ethical values | Are integrity, ethics, security responsibility, acceptable use, and expected conduct communicated and enforced? | Review code of conduct, acceptable use, HR/security policies, disciplinary process, and security culture practices. | Code of conduct, employee handbook, policy acknowledgments, disciplinary procedures. | Weak accountability and inconsistent security behavior. | Employees may bypass controls or mishandle sensitive data. | HR / Executive Leadership | Company-wide | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC1.2 | Security / Common Criteria | Control Environment: Oversight responsibility | Does governance or leadership provide oversight over security, risk, compliance, and control performance? | Review board/management oversight, security reporting cadence, and escalation processes. | Security committee minutes, leadership reports, risk review records. | Security risks not escalated or managed. | Unaddressed material weaknesses and slow remediation. | Executive Sponsor / CISO | Governance | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC1.3 | Security / Common Criteria | Control Environment: Structure, authority, responsibility | Are roles, reporting lines, authorities, and security responsibilities clearly defined? | Validate org chart, job descriptions, RACI, and control owner matrix. | Org chart, RACI, job descriptions, control owner list. | No clear ownership for controls. | Controls fail due to unclear responsibilities. | Executive Leadership / HR | Company-wide | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC1.4 | Security / Common Criteria | Control Environment: Competence | Are personnel qualified, trained, and supported to perform security and control responsibilities? | Review hiring practices, training, certifications, job responsibilities, and performance management. | Training records, job descriptions, certification records, onboarding checklists. | Personnel may lack required security skills. | Misconfiguration, poor response, audit findings. | HR / IT Manager | Employees and contractors | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC1.5 | Security / Common Criteria | Control Environment: Accountability | Are individuals held accountable for internal control responsibilities and security obligations? | Review performance management, control task ownership, escalation, and policy enforcement. | Performance review templates, task trackers, control ownership records. | Control tasks not performed on schedule. | Evidence gaps and repeated control failures. | Executive Leadership / CISO | Company-wide | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC2.1 | Security / Common Criteria | Information and Communication: Quality information | Does the organization obtain and generate quality information to support controls? | Review inventory, logs, reporting, monitoring, metrics, and data used for security decisions. | Asset inventory, risk reports, monitoring dashboards, vulnerability reports. | Decisions based on incomplete or inaccurate information. | Missed vulnerabilities, poor prioritization, control failure. | IT Manager / Security Lead | Security operations | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC2.2 | Security / Common Criteria | Information and Communication: Internal communication | Are security policies, control responsibilities, incidents, and risks communicated internally? | Review security announcements, training, escalation procedures, and internal reporting. | Policy acknowledgments, training records, internal memos, incident communication plans. | Employees are unaware of responsibilities. | Policy violations, incident delays, inconsistent processes. | CISO / HR | Company-wide | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC2.3 | Security / Common Criteria | Information and Communication: External communication | Are external parties informed about relevant security commitments, incidents, responsibilities, and customer obligations? | Review customer security commitments, vendor communications, incident notification procedures, and support processes. | Customer agreements, vendor notices, incident communication templates, support procedures. | External commitments not managed. | Contract issues, customer trust loss, compliance gaps. | Legal / Compliance Lead | Customers and vendors | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC3.1 | Security / Common Criteria | Risk Assessment: Objectives | Are security, availability, confidentiality, processing, and privacy objectives defined clearly enough to identify risks? | Review objectives, service commitments, control objectives, customer obligations, and risk appetite. | Security objectives, service commitments, risk appetite statement. | Unclear objectives lead to incomplete risk assessment. | Misaligned controls and weak prioritization. | CISO / Executive Sponsor | Governance | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC3.2 | Security / Common Criteria | Risk Assessment: Identify and analyze risks | Does the company identify, analyze, and prioritize risks to achievement of objectives? | Perform formal cybersecurity risk assessment covering systems, data, vendors, people, and processes. | Risk assessment report, risk register, treatment plan. | Undetected threats and unmanaged vulnerabilities. | Breach, outage, data loss, customer concerns. | CISO / Risk Owner | In-scope environment | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC3.3 | Security / Common Criteria | Risk Assessment: Fraud risk | Does the organization consider fraud, misuse, insider threat, and abuse scenarios in risk assessment? | Review fraud risk, privileged access abuse, financial/process manipulation, and unauthorized data access scenarios. | Fraud risk notes, insider threat review, privileged access review. | Fraud or abuse not considered in controls. | Financial loss, data exposure, trust damage. | CISO / Finance / HR | Sensitive processes | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC3.4 | Security / Common Criteria | Risk Assessment: Significant change | Are significant changes in business, technology, vendors, threats, or regulations identified and assessed? | Review change risk assessment, vendor changes, cloud migrations, new products, and threat landscape changes. | Change review records, risk reassessment notes, management approvals. | New risks introduced without review. | Misconfigured systems, missed controls, audit exceptions. | IT Manager / Change Manager | Change management | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC4.1 | Security / Common Criteria | Monitoring Activities: Ongoing evaluation | Are controls monitored through ongoing or periodic evaluations? | Review internal audits, control testing, management reviews, and automated monitoring. | Control testing records, internal audit reports, monitoring dashboards. | Control failures go undetected. | Audit gaps, security incidents, noncompliance. | CISO / Internal Audit | Control environment | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC4.2 | Security / Common Criteria | Monitoring Activities: Deficiency communication | Are control deficiencies identified, prioritized, communicated, and remediated in a timely manner? | Review remediation tracker, severity ratings, owners, target dates, escalation process. | Deficiency reports, remediation tracker, closure evidence. | Findings remain open or ignored. | Repeated audit findings and increased breach risk. | CISO / Control Owners | Control remediation | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC5.1 | Security / Common Criteria | Control Activities: Select and develop controls | Are control activities selected and designed to mitigate identified risks? | Review control design against risk register, policies, and system objectives. | Control matrix, risk-to-control mapping, design review. | Controls do not address actual risks. | False sense of security and audit exceptions. | CISO / Compliance Lead | Control design | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC5.2 | Security / Common Criteria | Control Activities: Technology general controls | Are technology controls developed for infrastructure, software, access, operations, and change? | Review ITGCs, system configurations, administrative access, backups, monitoring, and change approvals. | ITGC matrix, configuration evidence, change tickets, access reviews. | Technology controls are inconsistent or undocumented. | System compromise, downtime, audit gaps. | IT Manager / Network Administrator | IT systems | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC5.3 | Security / Common Criteria | Control Activities: Policies and procedures | Are controls deployed through documented policies and procedures? | Review policy set, procedure details, approvals, communication, and review cycles. | Policies, procedures, approval records, review logs. | Control expectations not documented or followed. | Inconsistent execution and insufficient evidence. | Compliance Lead / CISO | Policy program | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.1 | Security / Common Criteria | Logical Access: Access security architecture | Are logical access controls designed to restrict access to systems and protected information assets? | Review identity architecture, role-based access, authentication, authorization, network segmentation, and admin controls. | Access control policy, RBAC matrix, IAM configuration, network diagrams. | Unauthorized access due to weak architecture. | Data breach, privilege escalation, regulatory concern. | IT Manager / Identity Admin | IAM / infrastructure | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.2 | Security / Common Criteria | Logical Access: User registration and authorization | Are users registered, approved, and authorized before credentials are issued? | Review joiner process, manager approvals, ticketing, background checks where applicable, and account creation. | User provisioning tickets, approvals, onboarding checklist. | Unauthorized or inappropriate accounts created. | Excess access and insider misuse. | IT Manager / HR | User access | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.3 | Security / Common Criteria | Logical Access: Authentication | Are users authenticated before access is granted, including MFA where appropriate? | Review password standards, SSO, MFA, conditional access, privileged access authentication, and service accounts. | MFA screenshots, SSO policy, authentication settings, privileged account list. | Weak authentication or credential compromise. | Account takeover and unauthorized access. | Identity Admin / Security Lead | IAM / cloud / apps | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.4 | Security / Common Criteria | Logical Access: Access modification and removal | Are access rights modified or removed when roles change or users terminate? | Review movers/leavers process, termination timing, HR-to-IT workflow, access recertification. | Offboarding tickets, access removal logs, HR termination notices, access review evidence. | Former users or role-changed users retain access. | Data theft, unauthorized activity, audit finding. | HR / IT Manager | User lifecycle | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.5 | Security / Common Criteria | Physical Access: Facility and asset protection | Are physical access controls in place for offices, network equipment, endpoints, and data centers? | Review badge access, visitor logs, server room controls, CCTV, equipment inventory, and secure disposal. | Badge reports, visitor logs, server room access list, asset disposal records. | Physical theft or unauthorized facility access. | System outage, data exposure, equipment loss. | Facilities / IT Manager | Facilities / equipment | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.6 | Security / Common Criteria | Boundary Protection: External threats | Are controls implemented to protect systems from external threats and unauthorized network access? | Review firewalls, VPN, WAF, IDS/IPS, endpoint security, secure remote access, email protection, and cloud perimeter. | Firewall rules, VPN settings, EDR reports, email security settings, vulnerability scan. | External attacker gains access. | Breach, ransomware, service disruption. | Network Engineer / Security Lead | Network and cloud perimeter | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.7 | Security / Common Criteria | Data Movement: Transmission and removal | Are controls in place for transmission, movement, and removal of information? | Review encryption, DLP, file sharing, removable media, email forwarding, data export controls, and remote access. | Encryption settings, DLP policy, data transfer logs, approved sharing procedures. | Data exfiltration or uncontrolled disclosure. | Loss of confidentiality and customer trust. | Security Lead / Data Owner | Data transfer channels | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC6.8 | Security / Common Criteria | Malicious Software Protection | Are controls in place to prevent and detect malware, ransomware, and unauthorized software? | Review EDR/AV deployment, patching, application control, alerting, and response process. | EDR dashboard, malware alerts, endpoint coverage report, response tickets. | Malware or unauthorized software compromises systems. | Ransomware, data loss, downtime. | Security Lead / Endpoint Admin | Endpoints and servers | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC7.1 | Security / Common Criteria | System Operations: Detection of anomalies | Are systems monitored to detect anomalies, suspicious activity, and security events? | Review SIEM, log sources, alert rules, EDR alerts, cloud alerts, and monitoring coverage. | SIEM dashboards, log source inventory, alert rules, EDR reports. | Malicious activity goes undetected. | Long dwell time and larger breach impact. | Security Operations / IT Manager | Monitoring systems | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC7.2 | Security / Common Criteria | System Operations: Monitoring components | Are system components monitored for configuration, performance, availability, and security events? | Review infrastructure monitoring, cloud monitoring, endpoint status, network monitoring, and service health alerts. | Monitoring dashboard, uptime reports, device inventory, alert history. | Infrastructure issues or attacks are missed. | Outage, degraded service, delayed response. | Network Administrator / Systems Admin | Infrastructure | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC7.3 | Security / Common Criteria | System Operations: Security event evaluation | Are detected security events evaluated to determine whether they are incidents? | Review triage procedures, severity matrix, alert handling, escalation and incident classification. | Triage tickets, severity matrix, incident decision records. | Events not triaged or escalated properly. | Delayed containment and inconsistent response. | Security Lead / SOC Analyst | Incident triage | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC7.4 | Security / Common Criteria | System Operations: Incident response | Are incidents responded to using documented procedures, roles, escalation, and communication plans? | Review incident response plan, playbooks, roles, communication, evidence preservation, and tabletop exercises. | Incident response plan, playbooks, tabletop records, incident tickets. | Disorganized incident response. | Longer downtime, evidence loss, customer impact. | CISO / Incident Commander | Incident response | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC7.5 | Security / Common Criteria | System Operations: Recovery activities | Are recovery activities identified, developed, implemented, and tested after incidents or disruptions? | Review recovery plans, lessons learned, root cause analysis, corrective actions, and restoration evidence. | Post-incident reports, recovery records, corrective action tracker. | Failure to recover effectively or prevent recurrence. | Repeated incidents, downtime, audit concerns. | IT Manager / DR Owner | Recovery process | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC8.1 | Security / Common Criteria | Change Management | Are infrastructure, software, firewall, cloud, and application changes authorized, tested, approved, and documented? | Review change tickets, approvals, testing, rollback plans, emergency change procedures, and production deployment records. | Change tickets, approvals, test results, deployment logs, rollback plans. | Unauthorized or poorly tested changes. | Outages, security gaps, audit exceptions. | Change Manager / Engineering Lead | Applications and infrastructure | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC9.1 | Security / Common Criteria | Risk Mitigation: Business disruption | Are risk mitigation activities developed for business disruptions, security threats, and operational dependencies? | Review risk treatment plans, BCDR controls, insurance, contingency plans, and critical process dependencies. | Risk treatment plan, BCDR plan, mitigation tracker, dependency map. | Risks accepted without mitigation. | Operational failure or unacceptable downtime. | Risk Owner / Executive Sponsor | Risk management | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| CC9.2 | Security / Common Criteria | Risk Mitigation: Vendor and business partner risk | Are vendor and business partner risks assessed, managed, monitored, and documented? | Review vendor inventory, risk tiering, SOC reports, contracts, access, DPAs, and annual reviews. | Vendor inventory, vendor risk assessments, SOC reports, contracts, review evidence. | Vendor weakness impacts company systems or data. | Data exposure, service disruption, third-party audit gaps. | Vendor Manager / Compliance Lead | Third parties | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| A1.1 | Availability | Availability: Capacity and performance | Are processing capacity, system performance, and resource utilization monitored to meet availability commitments? | Review capacity planning, uptime monitoring, performance thresholds, scaling, and resource alerts. | Capacity reports, uptime reports, monitoring alerts, service-level reports. | Capacity constraints or performance issues not detected. | Customer-facing downtime or SLA issues. | IT Manager / Cloud Engineer | Production systems | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| A1.2 | Availability | Availability: Environmental protections and recovery support | Are backup, environmental, infrastructure, and recovery controls in place to support availability? | Review backups, replication, redundancy, environmental controls, cloud resilience, and DR infrastructure. | Backup reports, DR architecture, redundancy evidence, recovery procedures. | No recoverable backup or insufficient resilience. | Extended outage and customer impact. | Systems Admin / DR Owner | Critical systems | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| A1.3 | Availability | Availability: Recovery plan testing | Are disaster recovery, backup restoration, and business continuity plans tested regularly? | Review DR tests, restore tests, tabletop exercises, RTO/RPO metrics, and corrective actions. | DR test report, backup restore evidence, BCDR tabletop records. | Plans fail when needed. | Extended downtime and loss of customer trust. | DR Owner / IT Manager | BCDR program | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| C1.1 | Confidentiality | Confidentiality: Identify and maintain confidential information | Has confidential information been identified, classified, inventoried, and protected based on need-to-know? | Review data classification, data inventory, owners, access rules, encryption, and retention. | Data inventory, classification policy, access list, encryption settings. | Sensitive data not identified or protected. | Unauthorized disclosure, customer trust loss. | Data Owner / Security Lead | Confidential data | Client to assess | Critical | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| C1.2 | Confidentiality | Confidentiality: Protect and dispose confidential information | Are confidential information retention, transmission, storage, access, and disposal controls enforced? | Review retention schedules, secure disposal, encryption, DLP, file sharing, and archival processes. | Retention policy, disposal certificates, DLP policy, encryption evidence. | Improper retention or disposal of confidential data. | Data leakage, legal and customer issues. | Data Owner / Compliance Lead | Confidential data lifecycle | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| PI1.1 | Processing Integrity | Processing Integrity: Quality information | Is relevant, complete, accurate, timely, and authorized information used to support processing objectives? | Review input sources, data validation, process ownership, and exception reporting. | Process maps, data source inventory, validation rules, exception logs. | Incorrect or incomplete source data. | Bad outputs, customer errors, operational loss. | Application Owner / Data Owner | Processing systems | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| PI1.2 | Processing Integrity | Processing Integrity: Inputs | Are system inputs authorized, complete, accurate, and timely? | Review input controls, API validation, import logs, approvals, and error handling. | Input validation evidence, import logs, API controls, approval records. | Invalid or unauthorized data enters system. | Processing errors and inaccurate customer results. | Application Owner / Engineering | Applications / data inputs | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| PI1.3 | Processing Integrity | Processing Integrity: Processing | Are processing activities complete, valid, accurate, timely, and protected from unauthorized manipulation? | Review processing logic, job controls, error handling, reconciliations, and monitoring. | Job logs, reconciliation reports, exception reports, code review evidence. | Processing errors not detected. | Incorrect reports, financial or customer impact. | Application Owner / Engineering | Processing workflows | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| PI1.4 | Processing Integrity | Processing Integrity: Outputs | Are outputs complete, accurate, timely, and distributed only to authorized recipients? | Review output validation, reporting controls, recipient access, delivery logs, and exception handling. | Output reports, delivery logs, access lists, validation checks. | Incorrect or unauthorized outputs. | Customer disputes, data exposure, operational error. | Application Owner / Data Owner | Reports / outputs | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| PI1.5 | Processing Integrity | Processing Integrity: Storage, retention, and disposal | Are data storage, retention, and disposal processes aligned with processing requirements? | Review retention rules, database storage, archiving, disposal, backup retention, and data lifecycle controls. | Retention schedules, disposal logs, database policies, backup retention settings. | Data retained too long or lost too early. | Legal issues, lost records, privacy concerns. | Data Owner / Compliance Lead | Data lifecycle | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P1.1 | Privacy | Privacy: Notice and communication | Are privacy notices, policies, and practices communicated to data subjects and customers? | Review privacy policy, customer notices, website notices, contractual terms, and change communication. | Privacy notice, website policy, customer terms, notice change records. | Individuals are not informed of privacy practices. | Customer trust issues and privacy compliance gaps. | Privacy Lead / Legal | Personal information | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P2.1 | Privacy | Privacy: Choice and consent | Are choices, consent, opt-in/opt-out, and preference mechanisms documented and honored? | Review consent flows, opt-out controls, preference records, and processing basis. | Consent logs, preference records, opt-out procedures, screenshots. | Privacy preferences not captured or honored. | Complaints, contract issues, regulatory concern. | Privacy Lead / Product Owner | Personal information | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P3.1 | Privacy | Privacy: Collection | Is personal information collected only for disclosed, authorized, and necessary purposes? | Review data collection points, forms, APIs, logs, minimization, and purpose limitation. | Data collection inventory, form screenshots, API documentation, data mapping. | Overcollection or unauthorized collection. | Privacy exposure and increased breach impact. | Privacy Lead / Data Owner | Personal information collection | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P4.1 | Privacy | Privacy: Use, retention, and disposal | Is personal information used, retained, and disposed according to notices, policy, and business purpose? | Review data use cases, retention schedules, deletion process, archival rules, and disposal evidence. | Retention schedule, deletion tickets, privacy policy, data lifecycle records. | Data used outside disclosed purpose or kept too long. | Privacy risk, customer concern, legal exposure. | Privacy Lead / Compliance Lead | Personal information lifecycle | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P5.1 | Privacy | Privacy: Access by data subjects | Can individuals access, correct, or request actions on personal information as required by company policy and commitments? | Review data subject request process, identity verification, workflow, response timelines, and records. | DSR procedure, request log, identity verification evidence, response templates. | Requests mishandled or delayed. | Customer complaints and privacy compliance gaps. | Privacy Lead / Support Manager | Privacy requests | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P6.1 | Privacy | Privacy: Disclosure to third parties | Are disclosures of personal information to third parties authorized, documented, and limited? | Review third-party sharing, DPAs, vendor contracts, subprocessors, and transfer controls. | Vendor list, DPAs, subprocessors list, sharing map, approval records. | Unauthorized third-party disclosure. | Privacy incident and customer trust damage. | Privacy Lead / Vendor Manager | Third-party sharing | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P6.2 | Privacy | Privacy: Third-party privacy obligations | Are third parties required to protect personal information and report incidents as committed? | Review contractual clauses, vendor privacy/security reviews, breach notification duties, and monitoring. | Contracts, DPAs, vendor assessments, breach notification terms. | Third party fails to protect data or notify. | Privacy breach, delayed response, contract exposure. | Vendor Manager / Legal | Third parties | Client to assess | High | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P7.1 | Privacy | Privacy: Data quality | Is personal information maintained as accurate, complete, and relevant for its intended use? | Review data correction processes, validation controls, master data ownership, and customer update procedures. | Data quality reports, correction tickets, validation rules, customer update logs. | Incorrect personal information used. | Poor service, customer complaint, privacy issue. | Data Owner / Privacy Lead | Personal information | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
| P8.1 | Privacy | Privacy: Monitoring and enforcement | Are privacy controls monitored, complaints handled, and violations remediated? | Review privacy control monitoring, complaint tracking, incident escalation, policy enforcement, and training. | Privacy review reports, complaint logs, corrective action records, training evidence. | Privacy control failures persist. | Repeated issues and loss of customer trust. | Privacy Lead / Compliance Lead | Privacy program | Client to assess | Medium | OC Security Audit reviews, validates, documents gaps, maps controls, prepares evidence, and supports readiness remediation. |
Sample Report
Sample SOC 2 readiness report sections.
The existing sample report tables are preserved below and restyled for readability. They show the kind of control objectives, findings and documentation gaps that a readiness assessment can organize before the formal audit process.
Control Objective Review
| SOC 2 Area | Control Objective Reviewed | IT Perfection Current State | Readiness Status | Risk Impact | OC Security Audit Recommendation |
|---|---|---|---|---|---|
| CC1 Control Environment | Governance, ethics, security accountability, management oversight | Leadership is involved but formal security governance documentation and recurring management review evidence are incomplete. | Partial | Medium | Create formal security governance charter, assign control owners, and document recurring leadership review. |
| CC2 Communication and Information | Security communication, internal awareness, policy distribution | Security expectations are communicated informally; policy acknowledgment records are not centralized. | Gap | Medium | Implement policy acknowledgment tracking and annual security awareness communication records. |
| CC3 Risk Assessment | Formal risk identification, likelihood, impact, treatment, and ownership | No complete SOC 2-aligned risk register was available during review. | Gap | High | Perform formal risk assessment and maintain an approved risk register with treatment plans. |
| CC4 Monitoring Activities | Control monitoring, access review, alert review, remediation tracking | Security tools exist, but control monitoring evidence is inconsistent. | Partial | High | Define monitoring cadence, maintain review evidence, and track exceptions through closure. |
| CC5 Control Activities | Policies, procedures, approvals, segregation of duties | Core procedures exist operationally, but formal control narratives and approval evidence need improvement. | Partial | Medium | Create control matrix and document approval workflows for key operational controls. |
| CC6 Logical and Physical Access | MFA, least privilege, onboarding, termination, privileged access review | MFA is broadly enabled, but periodic access review evidence and privileged access justification are incomplete. | Partial | High | Implement quarterly access reviews, privileged account approval records, and termination evidence retention. |
| CC7 System Operations | Logging, monitoring, incident detection, vulnerability management | Tools are deployed, but alert review and vulnerability remediation evidence are not consistently documented. | Partial | High | Centralize security monitoring evidence and maintain vulnerability remediation tickets with closure dates. |
| CC8 Change Management | Change approvals, testing, implementation, emergency changes | Ticketing system records changes, but not all changes include approval, testing, and backout documentation. | Partial | Medium | Standardize change templates and require approval/testing evidence for in-scope systems. |
| CC9 Risk Mitigation | Vendor risk, third-party dependencies, business risk treatment | Critical vendors are known, but vendor risk reviews and security documentation are incomplete. | Gap | High | Create vendor inventory, risk tiering, annual review workflow, and evidence repository. |
| Availability | Backup, disaster recovery, capacity, uptime commitments | Backup tools exist, but restoration testing records and DR tabletop evidence are incomplete. | Partial | Medium | Document restoration tests, RTO/RPO targets, business continuity procedures, and incident escalation. |
| Confidentiality | Data classification, encryption, secure handling, access limitation | Encryption and secure access practices exist, but data classification and handling procedures require formalization. | Partial | Medium | Implement data classification policy, secure handling procedure, and encryption evidence collection. |
Sample Findings and Remediation
| Finding ID | Finding | Risk | Business Impact | Recommended Remediation | Target Owner | Target Timeline |
|---|---|---|---|---|---|---|
| F-01 | Formal SOC 2 risk assessment and risk register not fully documented. | High | Leadership may not have sufficient evidence of risk identification, risk treatment, and risk ownership. | Conduct formal risk assessment, assign owners, define treatment plans, and approve risk register. | CISO / Executive Sponsor | 30 days |
| F-02 | Quarterly access reviews are not consistently performed or retained. | High | Privileged or terminated users may retain inappropriate access to customer systems or internal platforms. | Implement quarterly access review workflow with screenshots, approvals, exceptions, and remediation evidence. | IT Manager / Network Administrator | 30–45 days |
| F-03 | Vendor risk management process is incomplete. | High | Third-party risk may not be evaluated for vendors supporting customer services or sensitive data. | Create vendor inventory, risk tiering model, vendor review checklist, and annual review evidence repository. | Operations / Compliance Owner | 45 days |
| F-04 | Change management records do not consistently include approval, testing, and implementation evidence. | Medium | Auditor may not be able to verify that in-scope production changes were authorized and tested. | Standardize change request form and require approval, testing, implementation, and emergency change fields. | Network Engineer / IT Manager | 45–60 days |
| F-05 | Incident response plan exists informally but has not been tested. | Medium | Response roles, escalation, communication, and evidence retention may be unclear during an incident. | Create formal incident response plan and perform tabletop test with attendance and lessons learned. | Security Lead / Management | 60 days |
Policy and Evidence Documents
| Document | Purpose | Current Status | Required Action | Owner |
|---|---|---|---|---|
| Information Security Policy | Defines security governance, responsibilities, and control expectations. | Needs Update | Update to include SOC 2 scope, control owners, review cadence, and management approval. | Security Lead |
| Access Control Policy | Defines user provisioning, deprovisioning, MFA, least privilege, and access reviews. | Missing Detail | Add privileged access workflow, quarterly reviews, exception handling, and evidence retention. | IT Manager |
| Vendor Risk Management Policy | Defines vendor onboarding, risk tiering, review, and monitoring process. | Missing | Create vendor policy, review checklist, security documentation request process, and annual review cadence. | Operations |
| Incident Response Plan | Defines detection, escalation, containment, communication, investigation, and lessons learned. | Partial | Formalize plan and perform tabletop test. | Security Lead |
| Business Continuity and Disaster Recovery Plan | Defines continuity procedures, recovery objectives, backup testing, and escalation. | Partial | Document RTO/RPO, backup ownership, restoration testing, and annual review. | IT Manager |
Evidence Readiness
We organize the proof behind your controls.
Evidence is where many SOC 2 readiness projects slow down. OC Security Audit helps identify and prepare access reviews, provisioning records, MFA screenshots, training records, risk assessments, vendor reviews, change tickets, incident logs, vulnerability scans, patch records, backup reports, firewall reviews, cloud security settings, endpoint protection status, monitoring records and policy approvals.
Access reviewsChange ticketsVendor reviewsRisk registerSecurity trainingBackup evidence
After The Readiness Review
Implementation and managed IT support through IT Perfection.
OC Security Audit identifies SOC 2 readiness gaps and security priorities. When your team needs help implementing Microsoft 365 controls, backup evidence, cloud configuration, endpoint management or ongoing IT operations, IT Perfection can provide related support while keeping the readiness consulting and managed IT roles distinct.
Microsoft 365 Managed ServicesOperational help with Microsoft 365 administration, configuration, user support and cloud management.
Backup and Disaster RecoverySupport for backup operations, disaster recovery planning and availability evidence.
Cloud ServicesCloud support for Azure, Microsoft 365 and infrastructure projects after readiness findings are prioritized.
Talk to IT PerfectionDiscuss implementation support after OC Security Audit identifies the readiness gaps.
Related OC Security Audit Services
Connect SOC 2 readiness with your broader security program.
Use related OC Security Audit services to strengthen the technical and governance foundation behind SOC 2 readiness.
Compliance ConsultingBroader compliance readiness, policy documentation and control planning.
Internal Security AuditReview internal controls, access, systems, users, procedures and evidence gaps.
Risk Assessment ServicesDocument risk, ownership, treatment priorities and executive reporting.
Microsoft 365 Security ServicesStrengthen Microsoft 365 controls that support SOC 2 readiness.
CISO Experience
SOC 2 readiness guidance from Ali Hassani, CISO.
Ali Hassani brings 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, network security, cloud security and infrastructure leadership experience to SOC 2 readiness work. His background helps organizations connect executive risk, technical controls, documentation, evidence and remediation priorities before entering the formal CPA audit process.
OC Security Audit helps leadership understand the risk, helps IT teams remediate technical gaps and helps operations document repeatable procedures that support customer trust.
FAQ
SOC 2 readiness questions customers ask.
Does OC Security Audit issue the SOC 2 report?
No. The official SOC 2 report is issued by an independent licensed CPA firm. OC Security Audit helps with readiness, consulting, gap assessment, control mapping, documentation, evidence preparation, risk assessment, remediation support, vendor review and audit preparation.
Can you help if we are starting from zero?
Yes. We can begin with discovery, scoping, gap assessment, missing controls, policy creation, evidence planning, risk documentation and a practical remediation roadmap.
Do you help with technical security issues?
Yes. We review practical technical areas such as Microsoft 365 security, Azure cloud security, identity and access management, firewall configuration, endpoint security, logging, vulnerability management, backup and incident response readiness.
Can SOC 2 readiness help with enterprise customer security reviews?
Yes. SOC 2 readiness often supports sales, procurement, vendor security questionnaires, investor due diligence and customer trust by organizing policies, evidence, controls and reports.
Prepare your company before the SOC 2 audit starts.
OC Security Audit helps identify gaps, create policies, map controls, prepare evidence, assess risk, review vendors, strengthen technical security and become ready for SOC 2 Type I or Type II.