Q: How to Become SOC 2 Compliant?

Answer: The process begins with what’s known as a SOC 2 Scoping & Readiness assessment, then culminates with the issuance of a SOC 2 Service Auditor’s Report. The readiness is the first step, and the audit report is the last step, so let’s fill in the blank and talk about all the steps in between on how to become SOC 2 compliant, courtesy of NDB, North America’s leading providers of SOC 2 compliance reports for service organizations.
Step-by-Step Process on How to Become SOC 2 Compliant.

1. Begin with a SOC 2 Scoping & Readiness Assessment: One of the most fundamentally important steps a service organization can take in becoming SOC 2 compliant is to begin with a SOC 2 Scoping & Readiness assessment. It’s not an additional cost that you have to incur, rather, an extremely beneficial and proactive pre-assessment process that helps identify control gaps, audit, scope, personnel participation, and so much more. Trying to become SOC 2 compliant with little or no preparation in the front-end is an actual recipe for disaster.

When performed by competent auditors, a SOC 2 Scoping & Readiness Assessment will ultimately save your organization both time and money in the long-run with SOC 2 compliance. To learn more, contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

2. Define the actual “Business Process”: As a service organization undergoing SOC 2 compliance, it’s important to identify what the actual business process is that’s going to be included in the scope of the SOC 2 audit. This is an important step because you’ll want to determine exactly what systems and related processes are going to be assessed and examined, thus mitigating any scope creep issues with the SOC 2 audit.

3. Choose the Relevant TSP’s: There are five (5) Trust Services Criteria to choose from – Security, Availability, Confidentiality, Processing Integrity, and Privacy. Each of them are unique, requiring a thoughtful analysis on which of the TSP’s you’ll want to include within the scope of your SOC 2 assessment. The vast majority of service organizations usually only choose the Security TSP, and that’s because it covers a large-range of critical I.T and operational issues and best practices.

4. Undertake Essential Remediation: Every service organization – and we mean “every” – will have some form of remediation to perform. How much? It all depends on how mature one’s control environment is or isn’t. Remediation can last as little as a few weeks, but can stretch out much longer, thus determining gaps and correcting them early on is a big priority.

5. Develop Outstanding Documentation: When it comes to SOC 2 compliance, service organizations will need to spend considerable time developing a wide-range of information security policies and procedures. Here is a short list of what’s needed for SOC 2 compliance:

• Access control
• Change management/change control
• Incident response
• Configuration management
• Anti-virus & anti-malware
• BCDRP

That’s just a small list of the growing number of InfoSec policies and procedures needed for SOC 2 compliance. Luckily, NDB has all the tools and templates needed for SOC 2 compliance, which means a huge savings in both time and money for service organizations. To learn more, contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today. Bottom line – documentation can be a very time-consuming endeavor when it comes to SOC 2 compliance. Don’t let it be – turn to the proven, trusted experts today at NDB.

6. Implement Required Security Tools and Solutions: Along with documentation requirements for SOC 2 compliance, service organizations will also find remediation being required in terms of security tools and solutions. Specifically, service organizations will need to implement File Integrity Monitoring, Two-Factor Authentication, Vulnerability Scanning, and more. You need to find the right tools at the right price – NDB can assist.

7. Perform a Risk Assessment: Another strict requirement for SOC 2 compliance is performing a much-needed risk assessment. There are a number of key risk areas that service organizations can choose from, and NDB offers a comprehensive risk assessment template program that’s complimentary to our clients. The document is easy-to-use, suffices for SOC 2 compliance, and provides great feedback in terms of organizational issues and risks. To learn more, contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

8. Get Moving with Security Awareness Training: What’s the very best way to train employees on emerging security issues, threats, and concerns? Security awareness training! It’s cost-effective, easy to implement, offers a great ROI in terms of educating employees, and it’s a requirement for SOC 2 compliance. There are a number of great security awareness training vendors online, so just do a simple search and you’ll surely find one.

9. Undertake Continuous Monitoring: What’s continuous monitoring – it’s the policies, procedures, and practices of regularly inspecting – and making changes, as necessary – to one’s control environment for purposes of today’s growing regulatory compliance mandates. Becoming SOC 2 compliant is a great milestone – no question about it – but service organizations will need to keep the momentum going by continuously monitoring their controls. NDB has a proven process that simply works, saving service organizations both time and money. Let’s talk today.

NDB. North America’s Leading Provider of SOC 2 Reporting

NDB has issued over a 1,000 SOC 1 and SOC 2 reports over the last decade. We know the AICPA SOC framework inside and out. Contact CPA Christopher Nickell at This email address is being protected from spambots. You need JavaScript enabled to view it. or at 1-800-277-5415, ext. 706 today. Whatever the industry – from banking to IT, manufacturing and more – NDB is the firm for helping you become – and stay – SOC 2 compliant. Let’s get started today.