Certified Lead SOC 2 Analyst cheat sheet

A SOC 2 examination reports on controls at a service organization relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; only Security (the common criteria) is mandatory.

The trust services criteria are organized as common criteria (CC1-CC9) plus supplemental criteria for Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P1-P8).

CC categories map to COSO components: CC1 control environment, CC2 communication and information, CC3 risk assessment, CC4 monitoring, CC5 control activities, CC6-CC9 logical/physical access, operations, change management, and risk mitigation.

SOC 2 is an attestation engagement performed under AT-C 205 (examination of prospective financial information is separate); the practitioner expresses an opinion on whether controls were suitably designed and operating effectively.

A Type 1 report covers suitability of design at a specified date; a Type 2 report covers design and operating effectiveness over a period (minimum commonly 3 months, typically 6-12).

SOC 2 reports are restricted-use under AT-C 205 to management, user entities, and specified parties; SOC 3 is a general-use seal report with no detailed description of tests.

The system description (Section III) must address infrastructure, software, people, procedures, and data, plus the services provided, boundaries, and relevant complementary user entity controls (CUECs).

Management asserts to the description and to the suitability of design and operating effectiveness; the service auditor's opinion addresses those assertions independently.

Readiness is not an opinion: a readiness assessment produces a gap analysis and remediation plan, whereas a SOC 2 examination produces an independent report with an opinion.

Scope is defined by the system boundary: the services, infrastructure, software, people, data, and processes that support the in-scope commitments in customer contracts and SLAs.

In-scope trust services criteria are driven by contractual commitments, marketing claims, and customer expectations; adding Availability, Confidentiality, or Privacy expands the criteria and evidence obligations.

Carve-out vs inclusive method: carve-out excludes subservice organizations' controls and discloses them with CUECs; inclusive includes them in the description and testing.

A gap analysis compares current controls and evidence against the selected criteria, producing a control gap register with owners, severity, and remediation dates.

Risk assessment should identify threats to the system (unauthorized access, availability loss, data leakage, processing errors) and map each to controls and criteria.

Materiality and significance guide scoping: processes and locations that could materially affect the system description or the opinion should be included.

Complementary subservice organization controls (CSOCs) and CUECs must be identified during scoping so responsibilities are allocated correctly.

Vendor and subservice organizations that store, process, or transmit in-scope data are candidates for carve-out disclosure or inclusive testing; document the rationale.

A scoping memo should record the system boundary, criteria selected, locations, infrastructure, and exclusions with justification for audit and management review.

A control must have an owner, a defined frequency, a population, a performance evidence artifact, and a test procedure that demonstrates design and operating effectiveness.

Evidence types: system-generated reports, screenshots with timestamps, tickets, approvals, logs, reconciliations, and management attestations; system-generated evidence is stronger than manual attestation.

Population completeness is tested by reconciling the control population (e.g., all changes, all terminations) to a source system report, then sampling from that population.

Sampling for operating effectiveness typically uses attribute sampling; larger populations and higher reliance require larger samples, and any deviation is evaluated for impact on the opinion.

Change management evidence includes request, approval, testing, segregation of duties between developer and deployer, and production deployment records.

Access control evidence includes provisioning approvals, periodic access reviews with sign-off, timely deprovisioning after termination, and privileged access monitoring.

Evidence must cover the entire examination period, not just a point in time; a control performed only once per year requires evidence of that occurrence within the period.

An exception is a deviation from the control description; it must be evaluated for severity, root cause, compensating controls, and whether it is isolated or systemic.

Evidence retention and version control matter: evidence should be dated, attributable to a performer, and stored where the auditor can retrieve it independently.

A SOC 2 Type 2 report contains: independent service auditor's report, management's assertion, system description, trust services criteria and related controls, tests of controls and results, and other information.

The opinion is unqualified, qualified, adverse, or disclaimer; a qualified opinion identifies a specific criteria or control area where the exception is material.

Section IV (tests of controls and results) must show the control, the test performed, the sample size, the results, and any exceptions; the auditor's conclusion follows the evidence.

Bridging letters and gap letters address the period between report dates; they are not substitutes for a new examination and are used to communicate control status to customers.

Continuous monitoring includes tracking control performance metrics, exception trends, remediation SLAs, and periodic internal audits or readiness refresh before the next examination.

Stakeholder trust is supported by a public trust center, NDA-gated report distribution, a defined report request process, and timely communication of material incidents.

Report distribution should be controlled: verify the recipient, log distribution, and require confidentiality acknowledgment because SOC 2 reports are restricted-use.

Incident response and breach notification commitments should align with contractual obligations and be evidenced in the monitoring program.

Management review of the SOC 2 report before issuance includes checking the system description for accuracy, completeness of CUECs, and consistency with actual practice.