Describe the service
Identify the system, customer commitments and examination boundary. Security applies to every SOC 2 examination. Include availability, processing integrity, confidentiality and privacy where relevant to those commitments.
SOC 2 readiness
Prepare evidence customers can rely on.
Define the service and systems in scope, then connect the relevant Trust Services Criteria to controls your team can demonstrate during an independent SOC 2 examination.
What reporting period did your customer request?
Confirm the service, criteria and dates in the customer’s assurance request before choosing the readiness work.
Compare the examination scope
- Type 1
- Discuss this route when the customer needs assurance about control design at a specified date.
- Type 2
- Discuss this route when the customer needs evidence that controls operated effectively over a specified period.
- Independent examination
- Vambrace helps organise evidence for readiness. The independent CPA firm carries out the examination and issues the report.
Engagement scope
Prepare for the independent examination
Agree the examination
A Type 1 report addresses control design at a specified date. A Type 2 report also addresses how effectively controls operated over a specified period. Discuss the report your customers need with the independent CPA firm.
Evidence the control in operation
For a privileged-access review, retain the population examined, the reviewer’s decision, the exception owner and the record of any access removed. Ensure the evidence corresponds to the examination date or period.
Which service and reporting period does your customer need assurance over?
Discuss SOC 2 readiness ↗