SOC 2 remediation prioritiser
Most readiness plans are a list in the order the gaps were found. This reorders yours by what an auditor tests first, what has a calendar lead time, and what you can honestly leave until after the window opens.
A gap assessment produces a list. The list is rarely in a useful order, because it comes out in the order the assessor walked the criteria rather than the order the work has to happen. Two things decide the real order, and neither is severity. The first is whether a control has to be operating on day one of the observation window. The second is whether the constraint is your effort or the calendar, because a training cycle and a restore test take a week of waiting whether you have one engineer or ten.
Tick the gaps that are open, say when the window opens and how much capacity you have, and this returns a sequence: what to start today, what belongs in the first month, and what can wait without costing you an exception. It also tells you whether your stated date is reachable at the capacity you described.
The sequence appears on this page. Nothing is emailed anywhere unless you ask for it at the end.
On its way
Allow one working day. If you would rather talk it through, book a time.
What the ordering is built from
Each gap carries three numbers. Audit risk is how likely that gap is to produce a qualified opinion or a named exception, scored one to five against what auditors actually test rather than against how bad it sounds. Effort is the working days to close it for a company under two hundred people. Lead time is the calendar days that pass regardless of effort, which is where most plans go wrong: booking a test, running a training cycle and completing a quarterly review all consume weeks in which no amount of extra staff helps.
Ordering is by risk divided by effort, so cheap high-risk items rise, and then anything with a lead time longer than the time remaining is pulled to the front whatever its score. That second rule is the one that changes real plans. A penetration test scores moderately and takes two days of your time, but if it takes six weeks to book and the report is wanted before fieldwork, it is a week one item.
What can genuinely wait
Two categories can wait. Controls that only have to be designed rather than operating, if you are going for a Type 1 opinion. And controls whose annual cycle can fall later in a long window, because a twelve month period has room for a training cycle in month seven while a three month period does not. Almost nothing else waits. A control that starts operating in month four of a six month window did not operate for the period, and the report says so.
The remediation plan page covers how to write this up for people who will ask why the order is what it is, and the timeline page sets out where the date pressure usually comes from.
Common questions
Should we fix everything before opening the window?
No, and waiting for a perfect position is the most expensive mistake in this process. Controls that must operate across the period have to be running on day one. Everything else can be closed during the window as long as it is closed before the auditor tests it, and a gap closed in month one of a six month window is a non-event. Opening late costs you a report date; opening with a control missing costs you an exception. Only one of those is recoverable by waiting.
Is a low-effort item always worth doing first?
Usually, because a quick item closed is a control that starts accumulating evidence sooner, and evidence is a function of time. The exception is anything with a long lead time, which has to start first even if it is expensive, because the constraint is the calendar rather than your hours.
How accurate are the effort numbers?
They are working days for a company under two hundred people with a normal cloud stack, and they assume the person doing the work already knows the system. They are honest for planning and wrong for any individual case. Multiply by about one and a half if the work involves changing how engineers deploy, because that cost is social rather than technical.
What if we are already inside the window with gaps open?
Close them and record the date they were closed rather than backdating anything. A control that began operating part way through the period normally produces an exception describing exactly that, which most customers accept alongside a remediation note. Reconstructing records to make it look otherwise is a different category of problem and it ends engagements.
Want the plan checked before you commit to a date
Send your gap list and the window you are aiming at, and Canadian firms that run readiness programs can tell you what the order should be.
Get matched