🔐 SOC 2 Audit — Key Areas

A quick-reference guide covering the five Trust Service Criteria, common controls, and evidence sources for SOC 2 Type II audits. Designed for interview prep.

COMMON CRITERIA — CC6

🛡️ Security

The system is protected against unauthorized access (both physical and logical).

  • Logical Access Controls: Role-based access control (RBAC), least privilege, MFA enforcement, session timeouts
  • Network Security: Firewalls, network segmentation, TLS encryption in transit, VPN enforcement
  • Vulnerability Management: Regular vulnerability scanning, patch management SLAs, secure coding practices
  • Incident Detection: SIEM integration, intrusion detection/prevention, real-time alerting
  • Physical Security: Badge access, visitor logs, surveillance for data centers
  • Change Management: Code review, approval workflows, automated deployment gates, rollback procedures
  • Asset Management: Asset inventory, lifecycle tracking, disposition procedures for hardware
Evidence Sources: IAM audit logs, vulnerability scan reports, incident response tickets, change management logs, network diagrams, penetration test reports, system configuration baselines
AVAILABILITY — A1

📈 Availability

The system is available for operation and use as committed or agreed.

  • Uptime Monitoring: Health checks, synthetic monitoring, status page dashboards
  • Capacity Planning: Resource utilization thresholds, auto-scaling rules, load testing
  • Incident Response: Defined severity levels, escalation paths, communication plans
  • Backup & Recovery: Automated backups, RTO/RPO testing, restoration drills
  • Disaster Recovery: Multi-region failover, DR runbooks, annual DR tests
Evidence: Availability reports, outage post-mortems, DR test results, backup logs, capacity reports
PROCESSING INTEGRITY — PI1

🧩 Processing Integrity

System processing is complete, valid, accurate, timely, and authorized. Most relevant for SaaS/transaction processing.

  • Input Validation: Schema validation, data type checks, client-side & server-side rules
  • Output Reconciliation: End-to-end transaction matching, report vs. source data validation
  • Error Handling: Graceful failure, retry logic, dead-letter queues, error alerting
  • Data Integrity: Checksums, hash validation, database constraints, referential integrity
  • Authorized Processing: Workflow approvals, segregation of duties, audit trails for batch jobs
Evidence: Data quality reports, reconciliation logs, error tracking dashboards, schema validations, transaction audit trails
CONFIDENTIALITY — C1

🔐 Confidentiality

Information designated as confidential is protected to meet the entity’s objectives.

  • Data Classification: Labels for Public, Internal, Confidential, Restricted/PHI
  • Access Restrictions: Need-to-know enforcement, metadata-driven access policies
  • Encryption: At-rest (AES-256), in-transit (TLS 1.2+), key rotation policies
  • Nondisclosure Agreements (NDAs): Tracking employee and vendor NDAs with expiry alerts
  • Secure Disposal: Media sanitization procedures, certificate/key destruction logs
Evidence: Data classification policies, encryption config audits, NDA tracking, access reviews, secure disposal certificates
PRIVACY — P1–P8

🛡️ Privacy

Personal information is collected, used, retained, disclosed, and disposed of properly per privacy notice and criteria.

  • Notice & Consent: Privacy policies, cookie consent banners, consent management platforms
  • Choice & Control: Opt-in/opt-out mechanisms, data subject rights (DSAR) workflows
  • Collection & Use: Data minimization, purpose limitation, retention schedules
  • Access & Disclosure: Consent records, third-party sharing agreements, data processing addendums (DPAs)
  • Quality & Integrity: Data correction procedures, accuracy checklists
  • Retention & Disposal: Automated purging, anonymization, legal hold exceptions
  • Monitoring: Privacy impact assessments (PIA), vendor privacy assessments
Evidence: Privacy policies, consent logs, DSAR processing records, retention audit reports, PIA documentation, vendor privacy questionnaires

⚙️ Automation Opportunities by Control

Each SOC 2 control below can be continuously monitored and evidenced via automation. This table maps specific AICPA-aligned controls to their automated implementation options.

Security (Common Criteria — CC)

ControlDescriptionAutomated Options / Evidence Sources
CC6.1 — Logical Access Logical access security software, infrastructure, and architecture are implemented to protect information assets from security events. SCIM-based user provisioning Auto-disable dormant accounts (>90d) MFA enrollment API polling (Okta/Azure AD) Just-in-time (JIT) access workflows Manual: Exception approval tickets
CC6.2 — Prior to Access Prior to issuing system credentials and granting system access, registration and authorization is completed. HRIS ↔ IAM sync via APIs New-hire workflow automation Manager approval webhook routing Manual: Role assignment committee review
CC6.3 — Access Removal Access is removed upon termination or change in job responsibilities. Offboarding automation on termination date Hourly audit: terminated users with active access Reconciliation between HR Data and IAM Manual: Emergency admin override approval
CC6.4 — Access Reviews Access is reviewed on a periodic basis and upon a change in job status or responsibilities. Automated quarterly recertification campaigns Manager email reminders + escalation Access review evidence exports (JSON/CSV) Auto-revoke unreviewed access after grace period
CC6.5 — Change Mgmt System infrastructure changes are authorized, tested, approved, implemented, and reviewed. IaC scanning (Checkov, Terraform Sentinel) CI/CD approval gates + artifact signing Drift detection via AWS Config / Azure Policy Automated rollback on critical alert Manual: Architecture Review Board for major changes
CC6.6 — Security Incidents Security incidents are detected, and their effects are contained, mitigated, and communicated. SIEM correlation rules (Splunk/Datadog) SOAR playbooks (Phantom, XSOAR) Auto-ticket creation + PagerDuty alerting IoC feed automation (MISP, threat intel APIs) Manual: Post-incident root cause analysis
CC6.7 — Vulnerability Mgmt Vulnerabilities are identified, evaluated for risk, and remediated on a timely basis. Continuous scanning (Qualys, Tenable) Auto-patch for low-risk, scheduled for critical SLA tracking script: open vs. closed by severity Container image scanning in CI (Trivy, Snyk) Manual: Exception justification with risk acceptance
CC6.8 — Network Security Network infrastructure and software are implemented to protect information assets from security events. Security Group / NSG rule audit scripts VPC Flow Log analysis (Athena / BigQuery) Automated NAC policy deployment Network segmentation drift detection
CC7.1 — System Monitoring System infrastructure and software are monitored for anomalies that indicate security events. CloudWatch/Azure Monitor anomaly detection Log ingestion to SIEM with auto-parsing File integrity monitoring (FIM) alerts AWS GuardDuty / Azure Sentinel findings
CC7.2 — Data Classification Data is classified to support the design and implementation of controls. AWS Macie / Azure Purview auto-classification DLP policy enforcement (Microsoft Purview) Tag compliance scans for bucket/database tagging

Availability (A1)

ControlDescriptionAutomated Options / Evidence Sources
A1.1 — System Monitoring Systems are monitored to detect anomalies that indicate availability threats. Synthetic monitoring (Pingdom, Datadog Synthetics) Health check automation with auto-restart APM alerts on latency/error rate thresholds
A1.2 — Recovery Procedures Recovery point objectives (RPO) and recovery time objectives (RTO) are established and tested. Scheduled backup verification scripts Automated DR failover drills (with failback) RTO/RPO measurement via runbook execution logs
A1.3 — Capacity Planning Capacity demands are monitored and projections are translated into capacity plans. Auto-scaling based on CPU/memory/disk thresholds Cloud cost anomaly detection Monthly capacity trend reports from monitoring APIs

Processing Integrity (PI1)

ControlDescriptionAutomated Options / Evidence Sources
PI1.1 — Input Validation Data is received completely, accurately, and in a timely manner. API schema validation (JSON Schema, OpenAPI) Great Expectations data quality checks Event sequencing validation via timestamps
PI1.2 — Error Handling Errors are identified, corrected, and resubmitted in a timely manner. Dead letter queue monitoring + auto-retry Error budget tracking (SRE approach) Automated error classification in Sentry/Bugsnag
PI1.3 — Output Reconciliation Output data is compared to input data to verify processing completeness and accuracy. Automated reconciliation pipelines (dbt, custom SQL) Report-to-source validation scripts Row count / monetary total balance checks
PI1.4 — Authorized Processing Data processing is authorized and approved by appropriate parties. Workflow approval engines (ServiceNow, Airflow) Digital signature / approval evidence logging Segregation of duties (SoD) rule automation

Confidentiality (C1)

ControlDescriptionAutomated Options / Evidence Sources
C1.1 — Classification Confidential information is identified, labeled, and protected. Auto data discovery & classification (Macie, Purview) DLP policy deployment across endpoints S3/Azure Blob tagging compliance scans
C1.2 — Encryption Confidential information is encrypted at rest and in transit. Automated encryption policy enforcement Key rotation monitoring (KMS/Key Vault APIs) Certificate expiry alerting + auto-renewal TLS version enforcement (TLS 1.2+ only)
C1.3 — Access Restrictions Confidential information is accessible only to authorized users. RBAC with principle of least privilege Data masking / field-level encryption for devs Access logging with automated anomaly detection
C1.4 — Disposal Confidential information is disposed of securely when no longer needed. Automated retention-based purging Shred/secure-delete verification scripts DLP archive removal automation Manual: Legal hold override management

Privacy (P1–P8)

ControlDescriptionAutomated Options / Evidence Sources
P1 — Notice & Communication Privacy notice is accurate, complete, and communicated to data subjects. Automated policy version tracking & publication Consent banner A/B testing analytics User acceptance tracking for ToS/Privacy Policy
P2 — Choice & Consent Data subjects can exercise choice and consent regarding collection. Consent Management Platform (OneTrust, TrustArc) Granular consent preferences (marketing, analytics, functional) Consent withdrawal propagation to downstream systems
P3 — Collection Personal information is collected consistent with the entity's objectives. Data minimization scanning: flag over-collection Form field validation to prevent unnecessary PII PI inventory mapping via data discovery tools
P4 — Use, Retention & Disposal PI is used, retained, and disposed of per policy and legal requirements. Automated retention schedules by data type PI purging workflows triggered by expiration date Anonymization/pseudonymization at end-of-life Manual: Legal hold override tracking
P5 — Access Data subjects can access and request correction of their PI. Self-service DSAR portal Automated DSAR data aggregation (cross-system search) SLA tracking: time-to-respond, time-to-fulfill
P6 — Disclosure PI is disclosed only to third parties per policy and consent. Third-party data sharing inventory via APIs Contractual DPA compliance tracking Vendor PI processing monitoring
P7 — Quality & Integrity PI is accurate and complete for its stated purpose. Data quality checks (duplicates, format validation) Automated correction workflows Periodic re-verification triggers
P8 — Monitoring Privacy controls are monitored to ensure ongoing compliance. Privacy KPI dashboards (consent rates, DSAR volume) Automated Privacy Impact Assessment (PIA) triggers Vendor privacy assessment scheduling
💡 Interview Tip: If asked “How do you automate SOC 2 evidence collection for ____?” — always map your answer to one or more of these five criteria, cite specific controls, and mention the evidence sources auditors actually expect.