New SOC 2 Checklist LM
New SOC 2 Checklist LM
Step 2: Identify the type of SOC2 report you need: SOC 2 Type I or SOC 2 Type II
Here's how you can identify which SOC2 report better fits your requirement.
We have undergone a SOC 2 audit before
Our SOC2 report requirement isn't urgent (within three months)
We have dedicated resources to develop and implement security policies
Our workforce understands their roles and responsibilities when implementing controls
We have a system in place to communicate system changes
If most of your answers are a no, it perhaps make better sense to start with a
SOC2 Type I audit. You can get to the SOC2 Type II audit once you have the security
controls and processes in place.
Step 3: Define the scope of compliance based on the Trust Service Criteria (TSC)
You should define the scope of your audit by identifying the TSC for which you want to
establish and test controls. The scope will depend on type of your business and your
customer requirements.
www.sprinto.com
SOC 2 CHECKLIST:
PREPARE FASTER FOR YOUR SOC 2 AUDIT
Processing Integrity
Are your processing systems providing timely and accurate data to users?
How do you ensure integrity of data?
Do you have specific procedures in place to correct errors quickly?
Privacy
Do you have a data retention policy that's documented and
communicated to customers?
Do you store personally identifiable information (PII)? If yes,
where and how do you store it?
Do you protect PII on your system?
Step 4: Conduct an internal risk-assessment
An internal risk assessment requires you to identify the risks associated with “growth,
location, or infosec best practices.” You must then assign probabilities to each risk identified,
estimate its adverse impact on your business, and put policies and measures in place to
mitigate them.
Have you identified the potential threats and associated risks to your business?
Have you estimated the potential impact of these threats on your business?
Have you tagged the critical systems based on the risks identified?
Have you developed mitigation startegies for the risks?
www.sprinto.com
SOC 2 CHECKLIST:
PREPARE FASTER FOR YOUR SOC 2 AUDIT
www.sprinto.com