SOC 2 preparation: the full walkthrough

Everything between the day a customer asks for a SOC 2 report and the day an auditor can start work, in the order it needs to happen.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

Preparing for a SOC 2 audit means producing four things: a written scope, a policy set that matches how you actually operate, controls that work, and evidence that they worked over time. For a Canadian company of ten to fifty people starting from nothing, that is roughly two to four months of work before the observation window can even begin. This page is the whole walkthrough, in order.

None of it requires an auditor's involvement. Auditors are prohibited from building the controls they later examine, so the preparation is yours either way. The only question is whether you do it internally or pay a consultant to run it, which the readiness overview covers.

Step one: write down the scope

Scope is the first decision and the one most often skipped. It determines what evidence you have to produce for the next year, so an hour of care here saves weeks later.

Write a single page that answers: which product or service is the audit about, which environments support it, which internal systems touch customer data, which third parties process data on your behalf, and which people have access. Anything not on that page is out of scope, and you should be able to defend why.

The system description you draft here becomes a real section of the final report, written by you and reviewed by the auditor. Starting it now rather than at fieldwork is the cheapest scheduling win available.

Step two: choose the criteria, and choose few

SOC 2 is built on five Trust Services Criteria. Security, sometimes called the common criteria, is mandatory. The other four are optional and each one adds controls, evidence and audit fee.

Canadian companies asking about the Privacy criterion should note that it is not a substitute for privacy law. If you handle personal information you are subject to PIPEDA, or to Law 25 in Quebec, whether or not it appears in your SOC 2 scope. Getaudited covers which privacy law applies to you, and that work is worth doing separately rather than bolting onto an audit.

Step three: find out what is missing

With scope and criteria fixed, compare them against reality. That comparison is the gap analysis, and it is the piece of readiness with the best return on a week of effort. The output is a ranked list of things you do not have, sorted by lead time rather than by severity, because a control that takes eight weeks to establish has to start before one that takes an afternoon.

Most first-time gap lists look similar. Access reviews have never been run. Offboarding is done by memory rather than a checklist. There is no vendor register. Logging exists but retention is thirty days when the observation window is ninety. Change approvals happen in conversation rather than in the pull request. Nobody has tested the backup restore. There is no risk assessment document of any kind.

Step four: write policies that describe your company

You need a policy set, and it needs to be approved, dated and acknowledged by staff. What it does not need to be is impressive. An auditor tests you against your own policy, so a downloaded template that promises quarterly penetration tests and a formal change advisory board creates findings you would not otherwise have had.

A first-audit policy set typically covers information security overall, access control, change management, incident response, business continuity and backup, vendor and third-party management, data classification and retention, risk assessment, acceptable use, secure development, and human resources security covering hiring, onboarding, training and offboarding. Some companies combine these into fewer documents, which is fine. What matters is that every commitment inside them is one you will keep every month for the length of the observation window.

Practical rules for writing them. Use "annually" instead of "quarterly" wherever an annual cadence is genuinely defensible, because you will have to evidence every cycle. Name roles rather than people, so a departure does not invalidate the document. Date and version every policy, and record who approved it, because the approval itself is evidence. Get acknowledgement from every employee at hire and once a year after that, in a system that produces a timestamp rather than a verbal yes.

Step five: remediation, in lead-time order

This is the longest stage and the one that needs engineering time. Work it in the order below, because the items at the top take calendar time to accumulate evidence and the items at the bottom can be done in a week whenever.

The penetration test deserves a note. SOC 2 does not name it as a requirement, but most auditors expect an independent test as evidence for vulnerability management, and enterprise customers ask for the letter regardless. Canadian pricing runs roughly $8,000 to $40,000 CAD depending on scope. Book it early enough that you can fix what it finds and show the fix inside the same window.

Step six: start collecting evidence before you think you need to

A Type 2 report tests whether controls operated across a period. That means the evidence has to exist for the whole period, including the first week, and there is no way to recreate an access review you did not run in March. Set the collection habit up before the window opens, not after.

The workable pattern for a small team is a folder per control, a naming convention that includes the date, and a recurring calendar entry for anything periodic with a named owner attached. Screenshots need the date, the system and the user visible in frame. Exports beat screenshots wherever a system can produce one. Tickets beat both, because they carry a timestamp and an approver you did not have to capture manually. The evidence collection page goes through what auditors accept and what they push back on.

Do you need a compliance platform

Compliance platforms connect to your cloud, identity provider and code repository and collect a portion of the evidence automatically. They also give you a control framework already mapped to the criteria, which is genuinely useful when you do not know what the control list should be.

They cost roughly $8,000 to $30,000 CAD a year, usually billed annually in advance, and the contract tends to be multi-year. They are worth it when your infrastructure is concentrated in one cloud, when you are above about thirty people, or when your team has no time to build collection habits. They are not worth it for a five person company with a single cloud account and one product, where the automated coverage is small enough that a spreadsheet and a calendar do the same job.

What no platform does is decide your scope, write your system description, run your access review, or fix a control you do not have. Roughly half the work on this page is unaffected by whether you buy one.

Step seven: the observation window

Once controls are running and evidence is being captured, you pick the window. Three months is the common minimum for a first Type 2. Six or twelve months is what mature buyers prefer, and what you will move to in year two so that reports run continuously without a coverage gap.

A Type 1 report tests design at a single date and needs no window at all. It is the right answer when a deal needs something now and a Type 2 cannot exist in time. It is not a lesser version of the same thing, it is a different test, and some enterprise buyers will accept it only with a committed date for the Type 2 to follow.

Book the audit firm before the window closes, not after. Good Canadian firms are booked out by a quarter or more, and finishing a flawless nine month window only to wait ten weeks for availability is a common and avoidable delay. The timeline page shows how the dates fit together, and GetSOC2 is where to compare firms once you are at that point.

What preparation costs in Canada

All figures Canadian dollars, all ranges, and none of them include the audit fee itself.

Common questions