Prepare for a SOC 2 audit

Controls, evidence and policies ready before the audit window.

1. Agree the audit period and the auditor (Head of security signs off)
2. Review and approve policies
3. Collect access reviews for each quarter. Most people forget this: Access reviews skipped in one quarter are hard to fix after the fact
4. Collect onboarding and offboarding tickets
5. Collect vendor risk reviews
6. Collect backup and restore test records
7. Answer the auditor's requests
8. Fix any exceptions

All recipes