SOC 2 Readiness Surface And Deliverables

SOC 2 readiness is the work a SaaS company does before an independent auditor examines its controls. System and Organization Controls (SOC) 2 is a framework from the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm tests your controls against the Trust Services Criteria (TSC) and issues a report. It is an attestation, not a self-certification badge.

This matters because enterprise buyers ask for the report before they sign. Gaps you already knew about get exposed during fieldwork, and fixing them then costs weeks. This lesson maps what you will deliver, who delivers it, and how auditors test it.

What a SOC 2 report contains

The report has four parts that you should be able to locate on sight.

• Management assertion. Your leadership states that the system description is fair and the controls meet the criteria.
• System description. Management writes it. It covers boundaries, infrastructure, software, people, processes, data, and service commitments.
• Auditor opinion. The CPA firm states whether the controls were suitably designed and, for Type II, operated effectively.
• Tests, results, and exceptions. Each control is tested, and any deviation is reported, including controls that never occurred so no conclusion could be reached.

The criteria appear in the description and the test tables. Here is how those parts fit together:

Who does what in a SaaS company

Named owners before the audit season prevent evidence requests from sitting unassigned for weeks. Responsibilities usually split this way.

• Compliance lead. Owns the program, maps controls, and acts as the auditor liaison.
• Engineering and IT. Run technical controls such as access, change management, and logging, and carry remediation.
• HR. Handles background checks, training, acknowledgments, and offboarding.
• Legal. Reviews vendor contracts and policies.
• Control owners and sponsor. Owners perform each control; an executive sponsor funds it and approves risk acceptance.

GRC (governance, risk, and compliance) tools centralize evidence, but they do not replace owners.

Owners beat heroesAssign one owner per control. A single audit hero becomes the bottleneck.

Timeline from readiness to report

Readiness comes first: scope, gap analysis, and a draft system description. Remediation follows, then controls must run. A Type I report is a point-in-time view and can follow soon after controls are implemented. A Type II report needs an observation window, commonly three to 12 months, with six months a leading-practice target.

Fieldwork then typically takes two to four weeks, and the report is issued afterward. Readiness results go stale, so aim to attest within about 12 months. Here is the sequence and its dependencies: