SOC 2 preparation: the full walkthrough

Everything between the day a customer asks for a SOC 2 report and the day an auditor can start work, in the order it needs to happen.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

Preparing for a SOC 2 audit means producing four things: a written scope, a policy set that matches how you actually operate, controls that work, and evidence that they worked over time. For a Canadian company of ten to fifty people starting from nothing, that is roughly two to four months of work before the observation window can even begin.

Which report you are preparing for changes the work, not just the invoice. Preparing for a Type 1 against a Type 2 covers what differs in evidence and timeline.

None of it requires an auditor. Auditors are prohibited from building the controls they later examine, so the preparation is yours either way. The only question is whether you do it internally or pay a consultant, which the readiness overview covers.

In your first month, the first thirty days covers the same ground week by week.

Step one: write down the scope

Scope is the first decision and the one most often skipped. It determines what evidence you have to produce for the next year, so an hour of care here saves weeks later.

What goes on the page

Write a single page that answers: which product or service is the audit about, which environments support it, which internal systems touch customer data, which third parties process data on your behalf, and which people have access. Anything not on that page is out of scope, and you should be able to defend why. The longer version of this decision, including the boundary tests that catch the systems people forget, is on scope and the system description.

The decisions that come up every time

The system description you draft here becomes a real section of the final report, written by you and reviewed by the auditor. Starting it now rather than at fieldwork is the cheapest scheduling win available, and what belongs in it is a ten-part list rather than a blank page.

Step two: choose the criteria, and choose few

SOC 2 is built on five Trust Services Criteria. Security, sometimes called the common criteria, is mandatory. The other four are optional and each one adds controls, evidence and audit fee.

The Privacy criterion is not a substitute for privacy law. If you handle personal information you are subject to PIPEDA, or to Law 25 in Quebec, whether or not it appears in your SOC 2 scope. Getaudited covers which privacy law applies to you, and that work is worth doing separately rather than bolting onto an audit.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Step three: find out what is missing

With scope and criteria fixed, compare them against reality. That comparison is the gap analysis, and it is the piece of readiness with the best return on a week of effort. The output is a ranked list of things you do not have, sorted by lead time rather than by severity, because a control that takes eight weeks to establish has to start before one that takes an afternoon.

Most first-time gap lists look similar. Access reviews have never been run. Offboarding is done by memory rather than a checklist. There is no vendor register. Logging exists but retention is thirty days when the observation window is ninety. Change approvals happen in conversation rather than in the pull request. Nobody has tested the backup restore. There is no risk assessment document of any kind.

Step four: write policies that describe your company

You need a policy set, and it needs to be approved, dated and acknowledged by staff. What it does not need to be is impressive. An auditor tests you against your own policy, so a downloaded template that promises quarterly penetration tests and a formal change advisory board creates findings you would not otherwise have had.

What a first policy set covers

A first-audit policy set typically covers information security overall, access control, change management, incident response, business continuity and backup, vendor and third-party management, data classification and retention, risk assessment, acceptable use, secure development, and human resources security covering hiring, onboarding, training and offboarding. Some companies combine these into fewer documents, which is fine. What matters is that every commitment inside them is one you will keep every month for the length of the observation window.

Four rules that prevent self-inflicted findings

Use "annually" instead of "quarterly" wherever an annual cadence is defensible, because you will have to evidence every cycle. Name roles rather than people, so a departure does not invalidate the document. Date and version every policy and record who approved it, because the approval is itself evidence. Get acknowledgement from every employee at hire and once a year after, in a system that produces a timestamp rather than a verbal yes. The policy templates page has the edit pass as a checklist you can tick off document by document.

Step five: remediation, in lead-time order

This is the longest stage and the one that needs engineering time. Work it in the order below. The items at the top take calendar time to accumulate evidence. The ones at the bottom can be done in a week whenever.

SOC 2 does not name a penetration test as a requirement. Most auditors expect an independent test as evidence for vulnerability management, and enterprise customers ask for the letter regardless. Canadian pricing runs roughly $8,000 to $40,000 CAD depending on scope. Book it early enough that you can fix what it finds and show the fix inside the same window.

Step six: start collecting evidence before you think you need to

A Type 2 report tests whether controls operated across a period. The evidence has to exist for the whole period, including the first week, and there is no way to recreate an access review you did not run in March. Set the collection habit up before the window opens, not after.

The workable pattern for a small team is a folder per control, a naming convention that includes the date, and a recurring calendar entry for anything periodic with a named owner attached. Screenshots need the date, the system and the user visible in frame. Exports beat screenshots wherever a system can produce one. Tickets beat both, because they carry a timestamp and an approver you did not have to capture manually. The evidence collection page goes through what auditors accept and what they push back on.

Do you need a compliance platform

Compliance platforms connect to your cloud, identity provider and code repository and collect a portion of the evidence automatically. They also give you a control framework already mapped to the criteria, which helps when you do not know what the control list should be.

They cost roughly $8,000 to $30,000 CAD a year, usually billed annually in advance, and the contract tends to be multi-year. They are worth it when your infrastructure is concentrated in one cloud, when you are above about thirty people, or when your team has no time to build collection habits. They are not worth it for a five person company with a single cloud account and one product, where the automated coverage is small enough that a spreadsheet and a calendar do the same job.

What no platform does is decide your scope, write your system description, run your access review, or fix a control you do not have. Roughly half the work on this page is unaffected by whether you buy one.

Deciding it in four questions

1. Is your infrastructure concentrated with providers a platform integrates with, meaning one cloud, one identity provider, one code host? If it is spread across four vendors and a colocation rack, automated coverage is small and the licence buys you a control framework rather than evidence.
2. Are you above about thirty people? Below that the manual collection is a few hours a month, and the licence costs more than the hours.
3. Does anyone in the building know what the control list should be? If not, the mapped framework is worth real money on its own, separately from the automation.
4. Can you commit to the contract term? Pricing is annual prepay and often multi-year, so the honest comparison is two or three years of licence against the hours it saves, not one.

Two yes answers make it worth pricing. Four make it obvious. One means buy a spreadsheet and a calendar entry instead, and revisit it before the second report.

If the answer is one, you still want the mapped control set that made question three worth asking, and you can get that without the licence. A free compliance workspace supplies the control set, the evidence register, policy templates and a risk register at no cost. TrazTech, which operates this site, runs one, and it checks seven common systems daily and files the evidence against the control. What it does not have is the integration breadth: seven connectors rather than hundreds, no endpoint agent and no HR system. Readiness without a paid platform lays out what each option covers and where the free ones stop.

Step seven: the observation window

Once controls are running and evidence is being captured, you pick the window. Three months is the common minimum for a first Type 2. Six or twelve months is what mature buyers prefer, and what you will move to in year two so that reports run continuously without a coverage gap.

Observation window

The period a Type 2 opinion covers. Real elapsed time, chosen by you, starting when controls are genuinely operating.

Type 1

An opinion on control design at a single date. No window, so it can follow readiness immediately.

Type 2

An opinion on design and on operation across the window. What most enterprise buyers now specify.

Fieldwork

The weeks after the window closes when the auditor requests populations, samples them and asks follow-up questions.

Exception

A control that did not operate as described during the window. Noted in the report with your management response. Survivable, and far better than an omission.

Bridge letter

A short statement covering the gap between the end of your window and a customer's request date. It is not an audit and carries no opinion.

A Type 1 report tests design at a single date and needs no window at all. It is the right answer when a deal needs something now and a Type 2 cannot exist in time. It is not a lesser version of the same thing, it is a different test, and some enterprise buyers will accept it only with a committed date for the Type 2 to follow.

Book the audit firm before the window closes, not after. Good Canadian firms are booked out by a quarter or more, and finishing a flawless nine month window only to wait ten weeks for availability is a common delay. The timeline page shows how the dates fit together, and GetSOC2 is where to compare firms once you are at that point.

What preparation costs in Canada

All figures Canadian dollars, all ranges, and none of them include the audit fee itself. If none of these lines are affordable yet, preparing with no compliance budget covers how much of this work costs nothing but hours, and SOC 2 with no security team sets out who does each part when nobody in the company works in security.

Common questions