SOC 2: trust services criteria and audit readiness
You learn the SOC 2 trust services criteria, the difference between Type 1 and Type 2, the system description and the control matrix, prepare a SaaS company for audit with evidence and read a SOC 2 report.
Level 301 · 18 lessons · 15 practice labs
Lessons
Basics
- SOC 1, SOC 2 and SOC 3
- The trust services criteria
- Type 1 and Type 2: a point and a period
- SOC 2 compared with ISO/IEC 27001
- Quick task: choose criteria for the scope
Readiness
- Writing the system description
- Building the control matrix
- The common criteria: CC1–CC9
- Complementary user and subservice controls
- The readiness assessment
- Quick task: a twenty-control matrix
Evidence and the period
- An evidence calendar for the period
- Populations and sample requests
- Exceptions and deviations
- Quick task: answer an auditor request with an evidence pack
Reading the report
- Reading a SOC 2 report: opinion, sections, exceptions
- Bridge letters and period gaps
- Capstone: prepare a SaaS start-up for a Type 1 audit
Practice labs
- Pick the report type: Match eight customer requests to the fitting report type.
- Choose criteria for the scope: For a payroll software service, choose with reasons which trust services criteria beyond security go into scope.
- Type 1, Type 2 or ISO: For three companies, recommend the Type 1, Type 2 or ISO/IEC 27001 route by customer expectation, timeline and maturity and justify it.
- Fill in the system description sections: Place the sentences of a service description in the infrastructure, software, people, procedures and data sections.
- A twenty-control matrix: Map twenty controls to the common criteria and fill in the owner, frequency and evidence columns.
- Find the uncovered common criteria: Compare a control matrix with the CC1–CC9 points of focus and write the uncovered criteria and the control needed.
- Identify the subservice organisations: From an architecture description, extract the subservice organisations and the controls relied on from them.
- Write the complementary user controls: Write six complementary controls that customers of a software service must operate themselves.
- A readiness assessment report: From Göktaşı Yazılım's control matrix and interview notes, write a report with the gaps, their priority and an audit-ready date.
- An evidence calendar for the period: Place on a six-month calendar which evidence is collected in which month from the frequency of fifteen controls.
- Answer an auditor request with an evidence pack: For five samples selected from the joiners population, compile approval, training and access evidence into a response pack.
- Prove the population is complete: Reconcile the change population with the source system export and write the completeness and accuracy statement.
- Find the section in the report: Match eight questions to the opinion, management assertion, system description and test results sections of a fictional report.
- Write a management response to an exception: Write a management response with cause, impact and fix for an exception where access removal was late in two samples.
- Bridge letter and the period gap: Calculate the gap between a provider's report period and today and write what the bridge letter does and does not cover.
About this course
You learn the SOC 2 trust services criteria, the difference between Type 1 and Type 2, the system description and the control matrix, prepare a SaaS company for audit with evidence and read a SOC 2 report.
What you will learn
- Basics
- Readiness
- Evidence and the period
- Reading the report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.