Writing a SOC 2 remediation plan

The gap list is not the plan. The plan is the gap list re-sorted by how long each item has to run before it produces evidence, which is almost never the same order.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

A useful SOC 2 remediation plan has four columns and one rule. The columns are the gap, the artifact that proves it is closed, one named owner, and the lead time. The rule is that the plan is sorted by lead time and not by severity, because a critical item you can fix on Tuesday afternoon does not affect your report date and a trivial item that needs a quarterly cycle to run does. For a Canadian SaaS company of 10 to 50 people coming out of a first gap analysis, expect 25 to 60 findings and 8 to 16 weeks of remediation before an observation window can honestly open.

25 to 60 Findings from a first gap analysis, 10 to 50 staff

8 to 16 weeks Typical remediation before a window can open

4 to 7 Findings that need a full cycle and set the date

Control gaps and evidence gaps are different problems

Sort every finding into one of these before anything else. Most plans that slip do it because the two were mixed together and estimated as if they were the same kind of work.

Control gap: The thing does not happen. No MFA, no vendor register, no branch protection. Fixing it is a project with a start and an end, and once it is done, it is done. Estimate these in engineering time.
Evidence gap: The thing happens but leaves no record an outsider could check. Access is reviewed in someone's head, changes are reviewed on a call, incidents are handled in a channel that gets archived. Fixing it is a habit change plus a place to put the artifact, and the fix does not produce evidence until the next cycle runs. Estimate these in calendar time.
Scope gap: The finding is only a finding because the boundary is drawn too wide. A legacy service nobody sells, a second cloud account for internal tooling, a product line not in the report. Sometimes the cheapest remediation is a narrower system description, and this is the one category worth checking before you spend money.

Why lead time beats severity as the sort order

Severity tells you what to worry about. Lead time tells you what to start today. The two orders agree less often than people expect, and the items at the bottom of a severity-sorted list are frequently the ones holding the date.

The same eight findings, sorted two ways
Finding	Severity rank	Lead time	Sets your date?
MFA not enforced for two admin accounts	1	An afternoon	No
Secrets in the repository	2	2 to 4 weeks	No
No log retention beyond 30 days	3	An hour, but urgent	Yes, retroactively impossible
No penetration test	4	4 to 8 weeks including remediation	Sometimes
Access review never performed	5	One full quarterly cycle	Yes
No vendor re-review cadence	6	One full annual or quarterly cycle	Yes
Training not tracked per person	7	One full cycle, plus rollout	Yes
Policies not acknowledged	8	A week	No

Four of the bottom five rows are what decide when your window can open, and three of them cost almost nothing in effort. That inversion is the reason the readiness scorecard attaches a lead time to every finding rather than a priority.

Retention is the only true emergency

Every other item on a remediation plan can be started late and finished. Log retention, pipeline run history and audit-trail settings cannot, because the records they would have kept are already gone. Change these on the day you read the gap report, before anybody argues about priorities.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

How do we work backwards to a window start date?

Take the date the customer needs the report. That is the only fixed point, and it usually came from a contract rather than from you.
Subtract 2 to 4 weeks for report issuance after fieldwork closes.
Subtract 3 to 6 weeks of fieldwork, longer if this is the auditor's first engagement with you.
Subtract the observation window itself. Three months is the shortest a Canadian CPA firm will normally opine on, and buyers increasingly ask for six.
What remains is your window start date. Every control on the plan has to be operating on that date, and every periodic control has to have run at least once before it or be scheduled to run inside the window.
If the arithmetic gives you a start date in the past, you have a scope conversation or a report-type conversation, not a remediation plan. The Type 1 or Type 2 page is where that decision gets made.

What goes in the plan itself?

One row per finding, and these columns. Anything else is decoration that nobody updates after week three.

Remediation plan columns, and what each one is for
Column	What it holds	Why it earns its place
Gap	The finding in one sentence, as the auditor would phrase it	Rewriting it in your own comfortable words is how gaps get quietly downgraded
Criterion	CC6.2, CC7.4 and so on	Lets you check coverage across the common criteria rather than by feeling
Closing artifact	The specific file, export or record that proves it	Forces the question of what evidence looks like before the work starts, not after
Owner	One person by name	Two owners is no owner. This is the column that predicts whether the row closes
Lead time	Days, weeks, or a full cycle	The sort key
Target date	An actual date, before the window start	Relative dates like "sprint 3" become undated the moment a sprint slips
Status	Not started, in progress, done, or accepted	Accepted is the honest fourth state. Some gaps get a written risk acceptance instead of a fix

When is accepting a gap the right answer?

More often than most readiness vendors will tell you, because every gap they persuade you to close is billable. A written acceptance signed by management is a legitimate outcome under CC3 and CC9, and auditors read one far more kindly than a fix that was rushed and does not hold.

Accept a gap when the control does not fit how you operate, the compensating control is real and evidenced, and the reasoning is written down. A six-person engineering team cannot separate author and approver on every change. The answer is a documented compensating control, not a fictional separation of duties that fails the first sample. Do not accept a gap because it is expensive or because nobody wants to own it. Auditors distinguish the two easily, and so do the customers reading the exceptions in your report.

The counter-case for fixing everything

If this report is going to a US enterprise security review rather than to a mid-market buyer, a clean report is worth real money and accepted gaps become questions on a call. That is a commercial argument for closing items you would otherwise accept. What a US buyer actually reads is the page to weigh it against.

Before you call the plan finished

0 of 0 done ·

Every retention setting changed already, before anything else on the plan started
Every full-cycle item identified and scheduled, with the longest one marked as the constraint on the window start
One named person per row, and every one of them has seen the row
Closing artifact named for each row, specific enough that somebody else could go and find it
Target dates are calendar dates and all of them fall before the window start
Accepted gaps have a written rationale and a compensating control, signed by someone with the authority to accept risk
Scope-driven findings checked against the system description before being funded as fixes
A weekly fifteen-minute review booked, with the window start date visible in the invitation
Plan shared with the audit firm if one is already engaged, so the window start is agreed rather than announced

How long does SOC 2 remediation take?

Eight to sixteen weeks for a Canadian SaaS company of 10 to 50 people starting from a first gap analysis, and the spread is driven by how many findings need a full cycle of a periodic control rather than by the number of findings. Companies with an identity provider and a real pipeline land at the short end.

Should we remediate before or during the observation window?

Before, for anything that is a control gap. A control implemented in month two of a three month window did not operate for the whole period, and the auditor will say so in the report. Evidence habits can be tightened during the window, controls cannot.

Who should own the remediation plan?

One person inside the company, usually the head of platform or engineering, even when a consultant wrote it. A plan owned by the consultant stops moving the week the engagement ends, and the rows that need a colleague to change their habits are exactly the rows an outsider cannot close.

Do we need a consultant to write the plan?

No. If you have a gap analysis, the plan is a re-sort of it and a day of work. Where outside help earns its fee is in estimating lead times you have not seen before and in telling you which findings are scope problems. The gap analysis page covers what to buy and what to do yourself.

What if we cannot finish before the window has to start?

Start the window with the unfinished items on record and a management response written, or move to a Type 1 and follow it with a Type 2. Both are survivable. Starting the window and hoping nobody samples the gap is not, since the population is produced from your own systems and the gap is in it.

Get the plan reviewed before you commit to a date

Send the gap list and the date you have been given. Firms that do this work will tell you whether the arithmetic holds.

Get matched