SOC 2 Type II audit readiness in six months

The challenge

A financial intermediary sells a SaaS solution to US clients, who require SOC 2 Type II compliance. The team has 15 people, a part-time CISO and no IT director, and technical and documentation debt to clear.

What we did

• Compliance scoping and comparison of compliance management tools (total cost, time to value, SOC 2 criteria coverage, integrations, usability), with selection workshops bringing business and IT together.
• First rollout on a market tool, then, given its limits (configuration effort, delays, costs), a reasoned decision to switch tools, with a plan to carry over requirements and evidence that kept the audit schedule.
• Mapping from SOC 2 requirements to controls to expected evidence (logs, reports, policies, tickets), traced in the tool.
• Control lifecycle: definition, execution, automated or semi-automated evidence collection, validation and periodic reviews.
• Integrations: single sign-on and MFA, ticketing, SIEM, vulnerability management, coverage dashboards.
• Change management: guides, training for control owners, go-live support.
• Audit readiness: controls run over the observation period, dry-run audits and fixing non-conformities.

What changed

• SOC 2 Type II audit file prepared in six months.
• Technical debt cleared in one year.
• Less time spent collecting evidence, and full traceability from requirements to evidence.
• A real-time view of SOC 2 coverage and compliance run as an everyday process.

This is the Organise activity of Trusted Organisation: security governance that produces its evidence as it goes.