mkurman/soc2-prep

----|--------|--------| | Risk | ALE coverage (mitigated / total) | > 80% | | Detection | Mean Time to Detect (MTTD) | < 24 hours | | Response | Mean Time to Respond (MTTR) | < 4 hours | | Compliance | Controls passing audit | > 95% | | Hygiene | Critical patches within SLA | > 99% | | Access | Privileged accounts reviewed quarterly | 100% | | Vendor | Tier 1 vendors assessed annually | 100% | | Training | Phishing simulation click rate | < 5% |

Trust Service Criteria Overview

Security (Common Criteria -- always in scope): CC1-CC2 (control environment, communication), CC3 (risk assessment), CC4-CC5 (monitoring, control activities), CC6 (logical/physical access, encryption), CC7-CC8 (system ops, vulnerability mgmt, incident response, change mgmt), CC9 (vendor management, business continuity).

Optional: Availability (A1), Processing Integrity (PI1), Confidentiality (C1), Privacy (P1-P8).

Essential Policies (10 minimum)

Information Security, Access Control (MFA, least privilege, access reviews), Change Management (code review, rollback), Incident Response (detection through post-mortem), Risk Assessment (annual, with register), Vendor Management, Data Classification, Business Continuity/DR (RTO/RPO, backup testing), Acceptable Use, HR Security (background checks, onboarding/offboarding).

Vendor Security Assessment Tiers

| Tier | Data Access | Assessment Level | |------|------------|-----------------| | Tier 1 | PII/PHI access | Full assessment annually | | Tier 2 | Business data | Questionnaire + review | | Tier 3 | No sensitive data | Self-attestation |

Red Flags to Surface Proactively

• Security budget justified by benchmarks rather than risk analysis
• Certifications pursued before basic hygiene (patching, MFA, backups)
• No documented asset inventory -- cannot protect what you do not know you have
• IR plan exists but never tested; security reports to IT, not executive level
• Security questionnaire backlog > 30 days -- silently losing enterprise deals
• Vendor with sensitive data access has not been assessed

Startup-Specific Guidance

Type I vs Type II: Type I examines control design at a point in time (3-6 months, good for closing the first enterprise deal). Type II examines control operation over 3-12 months (what sophisticated buyers want, plan 12 months total). Start Type I immediately; begin Type II observation once controls are in place.

Right-Sizing by Stage: Seed (5-15): foundational controls, automation-heavy, concise policies, one part-time owner. Series A (15-50): dedicated compliance owner or fractional CISO, formal access reviews. Series B+ (50+): full-time security team, internal audit, GRC platform.

Cost-Effective Tooling: Compliance automation (Vanta, Drata, Secureframe — significantly reduces manual effort), SSO (Google Workspace or Okta), MDM (Kandji or Jamf), monitoring (Datadog, PagerDuty), vulnerability scanning (Dependabot, Snyk, Trivy).

Timeline Templates

• Type I Aggressive (3 months): Month 1 scope/gap/policies, Month 2 implementation, Month 3 readiness + audit.
• Type I Standard (6 months): Months 1-2 scope/policies, 3-4 implementation, 5 evidence, 6 audit.
• Type II (12 months): Months 1-6 complete Type I, 6-12 observation + evidence, Month 12 audit.

Output Confidence Tagging

All findings tagged before reaching decision-makers: Verified (confirmed against evidence), Medium (reported but not independently verified), Assumed (inferred, needs validation).

Related Skills

• privacy-policy — SOC 2 Privacy criteria (P1-P8) align directly with privacy policy commitments. Ensure consistency.
• security-review — Technical security controls from security-review map to SOC 2 Common Criteria (CC6, CC7, CC8). Use findings to inform gap analysis.

Examples

Example 1: Enterprise deal requires SOC 2

User: "A prospect wants SOC 2 before signing a $200K contract. We have nothing."

Good output excerpt: > Business case: This $200K deal justifies a $30-50K compliance investment. At your stage, every enterprise deal blocked by missing SOC 2 has an opportunity cost. > > | Area | Status | Key Gaps | > |------|--------|----------| > | Access Control | Partial | MFA not enforced on AWS root, no SSO, no formal reviews | > | Change Management | Partial | GitHub PRs used but no documented policy | > | Incident Response | Missing | No documented plan, no on-call rotation | > | Risk Assessment | Missing | No formal risk assessment conducted | > > Recommended approach: Type I in 3 months, then begin Type II observation. > Immediate actions: (1) Sign up for compliance automation. (2) Enforce MFA everywhere. (3) Select an auditor with startup experience. > Interim response to prospect: Share security questionnaire response, SOC 2 Type I commitment timeline, and a signed mutual NDA with security addendum.

Example 2: Security posture assessment

User: "We already use Okta for SSO and do code reviews. Where are we relative to SOC 2?"

Good output excerpt: > Gap Analysis Summary: 55% ready > > Compliant: CC6.1 Okta SSO with MFA, CC8.1 code reviews via PRs. > Partial: CC6.2 no quarterly access reviews documented, CC7.2 IRP never tested, CC6.3 no formal offboarding checklist. > Missing: CC3.1 no annual risk assessment, CC2.1 no security training, CC9.2 no vendor management, CC4.1 no control monitoring, all 10 required policies need drafting.

Disclaimer: This skill provides SOC 2 preparation guidance for planning purposes only. It does not constitute legal, audit, or professional compliance advice. SOC 2 reports can only be issued by a licensed CPA firm. Engage a qualified auditor to confirm readiness before scheduling an audit.