The documents and records a SOC 2 runs on: which policies to write, the information security policy, training, background checks, joiner and leaver records, access reviews, retention and disposal, and how evidence is collected for the auditor.
The policy set a SOC 2 examination expects, mapped to the criteria rather than a vendor template: code of conduct, information security, access, change, incident response, vendor management, retention and disposal, and how often they must be reviewed.
How to write the top-level information security policy a SOC 2 auditor reads first: standards of conduct, roles and authorities, accountability, risk assessment and communication, kept short enough that the team actually follows it.
What SOC 2 expects for security awareness training: the CC1.4 and CC2.2 points of focus, privacy awareness when privacy is in scope, the completion records auditors sample, and running training on a self-hosted learning platform.
Whether SOC 2 requires background checks and how auditors test them: the CC1.4 point of focus on background, contractors and vendor staff, evidence for new hires during the period, and what EU customers may also ask suppliers for.
The joiner and leaver records a SOC 2 auditor samples: access approved before credentials are issued, timely removal of logical and physical access, device recovery, and automating provisioning and deprovisioning from the identity provider.
How to run the periodic user access reviews SOC 2 auditors test: scope, reviewers and frequency, evidence that removals happened, and which open-source identity tools include access certification in their free editions and which keep it in paid tiers.
How to set retention and disposal rules that satisfy SOC 2: the confidentiality and privacy criteria on retaining and destroying information, disposing of devices and media, NIST SP 800-88 sanitization, and the records that prove disposal happened.
How to collect SOC 2 evidence that survives testing: system-generated reports, tickets and pipeline artifacts over screenshots, what automation platforms can and cannot do, contract terms that limit the auditor's access to evidence, and over-reliance on inquiry.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.