The Audit Preparation Timeline

Most teams underestimate how much time SOC 2 preparation takes. Here's a realistic timeline working backward from your audit start date.

|---|---|

Phase 1 — Scope Definition

Before evidence collection, you need to agree on what's in scope.

Systems in scope: Which products, services, and infrastructure components? Be specific. An auditor cannot evaluate what's undefined.

Trust Services Criteria in scope: Security is always included. Do you need Availability? Privacy?

Boundaries: Where does your system start and end? What third-party services are included? Your cloud provider (AWS) is typically included; their compliance is inherited through a Shared Responsibility Model acknowledgment.

Shared Responsibility Memo: Document what AWS provides (physical security, hypervisor, managed service security) vs. what you're responsible for (IAM, encryption config, OS patching).

Phase 2 — Control Gap Assessment

Run through each control category and identify gaps before your auditor does.

Technical Controls (automated)

• [ ] MFA enforced on all privileged AWS IAM users
• [ ] No root account access keys
• [ ] CloudTrail enabled in all regions
• [ ] S3 buckets: encryption enabled, public access blocked, SSL-only policy
• [ ] RDS: encryption at rest enabled
• [ ] GuardDuty enabled
• [ ] Inspector enabled for EC2/Lambda/ECR
• [ ] WAF configured in front of public-facing applications
• [ ] VPC: no unrestricted SSH/RDP ingress rules
• [ ] KMS key rotation enabled
• [ ] Secrets Manager in use (no hardcoded secrets)

Organizational Controls (manual)

• [ ] Written Information Security Policy
• [ ] Acceptable Use Policy
• [ ] Incident Response Plan and runbooks
• [ ] Business Continuity / Disaster Recovery Plan
• [ ] Vendor Risk Management Policy
• [ ] Background check process documented
• [ ] Security awareness training program (and records of completion)
• [ ] Access review process (quarterly) with documented evidence
• [ ] Change management procedure
• [ ] Data classification policy

Phase 3 — Evidence Packaging

Your auditor will request specific evidence for each control. Common evidence types:

For technical controls:

• Configuration screenshots with timestamps
• AWS Config rule results
• CloudTrail logs for key events
• Automated scan results (SecureSpect reports export directly)

For organizational controls:

• Signed policy documents with effective dates
• Employee training completion records
• Quarterly access review meeting notes or ticket records
• Incident response test exercise documentation
• Vendor security questionnaire responses

Evidence organization tip: Create one folder per control, named by control ID (e.g., CC6.1 — Logical Access). Inside each folder, put the evidence documents. Auditors work from a Population and Sample request list — organized evidence dramatically reduces back-and-forth.

Phase 4 — Team Readiness

Your auditor will conduct walkthroughs — conversations with your team to understand how controls operate in practice.

Who the auditor typically talks to:

• CTO / Head of Engineering — overall security posture
• DevOps / Infrastructure lead — AWS configuration, deployment processes
• Engineering manager — code review, change management
• HR or People lead — background checks, onboarding/offboarding
• CEO or COO — organizational oversight

How to prepare your team:

• Run a mock walkthrough internally
• Make sure everyone can explain what they do, not just that a control exists
• Auditors are looking for evidence that controls are understood and followed — not memorized

Phase 5 — Selecting a SOC 2 Auditor

SOC 2 audits must be conducted by a licensed CPA firm. You cannot self-certify.

What to compare when selecting:

• Industry experience: Auditors who specialize in SaaS will move faster
• Fixed vs. time-and-materials pricing: Fixed-fee engagements are more predictable
• Timeline: Can they meet your deal deadline?
• Readiness assessment: Does the firm offer a pre-audit readiness check?
• Report delivery: How long after audit completion until the report is issued?

Well-known SaaS-focused auditors include Schellman, Prescient Assurance, A-LIGN, and Johanson Group — but the field is wide. Get at least two quotes.

Common Audit Failures to Avoid

Undocumented controls — A control that exists but isn't documented in a policy or runbook often doesn't count.

Evidence gaps — "We do this" without a log or screenshot to prove it.

Orphaned access — Former employee accounts still active at audit time.

Untested backups — Backups that have never been restored aren't evidence of availability controls.

No change management process — Deploying code without a documented approval or review trail.