What's Inside

What is a SOC 2 Readiness Assessment? 

A readiness assessment is a practice run for your SOC 2 audit. You examine the same aspects of your business as an auditor would. The difference is the stakes are much lower.

Assessments inevitably discover missing or non-compliant controls that could derail an audit. Having a chance to correct things before auditors arrive makes a successful SOC 2 audit more likely.

When Should You Conduct One? 

You should start your assessment twelve to eighteen months before you need the final SOC 2 Type 2 report. Let’s work backward from the completed report to see why.

The report itself takes several weeks to prepare. Then there’s the time it takes to conduct the audit. Type 2 audits cover a specified period that you determine with the auditing firm. Six or 12-month audit periods are the most common, though the AICPA does not define required periods, so you will see some SOC 2 Type 2 reports that cover three months for example. 

During the audit, you don’t want any exceptions to compromise its results. Your customers may accept a few easily-corrected issues. An auditor’s opinion that tells customers you can’t control your security could be disastrous.

To avoid exceptions, you must be SOC 2 compliant before the audit starts. Getting to that point could take months as you address the issues your assessment uncovers.

The assessment itself could take weeks or months, depending on the scope of your planned audit.

Starting your readiness assessment 12 to 18 months ahead of the final report gives your organization time to find and address every compliance gap before the audit begins.

What Your Auditor Will Look For

Companies need SOC 2 compliance because they store, process, or transmit their customers’ data. That covers a broad landscape of cloud computing platforms, software-as-a-service providers, and business service companies. As a result, the specifics of every organization’s SOC 2 audit differ.

When you retain a CPA firm, you will define the audit’s scope, including which criteria in the SOC framework to evaluate.

SOC 2 Trust Services Criteria

When you retain a CPA firm, you will define the audit’s scope. This scope includes which criteria defined in the Association of International Certified Professional Accountants (AICPA) SOC framework apply to your business. These criteria fall under five Trust Services Criteria (TSC) categories:

• Availability

• Confidentiality

• Privacy

• Processing integrity

• Security

All SOC 2 audits include security criteria. Which, if any, of the other four TSC categories your audit should include depends on the nature of your business. 

The criteria within each TSC describe goals companies should achieve but do not dictate how companies achieve those goals. A small startup and a global enterprise have different resources and risks. The TSCs allow companies to develop controls that make the most sense for their businesses. 

How Much do Readiness Assessments Cost?

Before we get to that, consider this question: what is the cost of a flawed SOC 2 audit? 

Depending on the scope and other factors, an audit can cost $7,500 to $100,000. However, the business impact of non-compliance is the real cost. Inadequate security controls raise the financial and legal risks of a successful breach. Moreover, SOC 2 non-compliance will stall growth as potential customers take their business elsewhere.

A readiness assessment will examine the same things as your future auditors, so expect to pay a similar amount. In addition, you will pay to remediate the compliance gaps your assessment uncovers.

A better way to think about your assessment is as the testing phase of the SOC 2 process. Software developers perform unit and acceptance testing to ensure their code works before release. Engineering tests alpha, beta, and pilot builds before going into production. These activities have costs but make the final product more robust and fit for purpose.

Readiness assessments are investments in the quality of your SOC 2 compliance process.

Determining Your Readiness

Plan your assessment in the context of your company’s overall SOC 2 strategy to ensure it lays a solid foundation for your audit.

You may want to consider the financial and cultural benefits of a self-assessment. 

Although the cost savings are relatively small, they might appeal to small startups with tight budgets. In addition, the scope of a small company’s audit may not justify hiring an outside consultant.

A more significant benefit of doing it yourself is the security-first culture self-assessments help you build.

Developing, implementing, and supporting SOC 2 controls does not happen in the cloistered chambers of your compliance group. Everyone from the executive team to frontline staff to your third-party vendors must contribute. Readiness self-assessments involve all stakeholders, making it clear that SOC 2 compliance is a shared goal.

From Readiness to Continuous Compliance

A SOC 2 readiness assessment is the right way to prepare your organization for an audit. However, fixing the issues your assessment uncovers does not mean your company will remain compliant. Things as simple as a missed software patch during the audit become exceptions in the final report.

Continuous SOC 2 compliance monitoring is the only way to remain compliant. Doing this manually is impractical. Drata’s monitoring solution automatically collects evidence for you and your auditor.