A tailored course, built for your situation
Reference of choice on SOC 2 control decisions
Become the internal authority your team trusts on SOC 2 compliance design and implementation
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Mid-level compliance and governance practitioners contributing to audit and control workflows, aiming to transition from task execution to recognised subject matter contribution on SOC 2
Who this is not for
Executives seeking board-level oversight frameworks or strategic compliance roadmaps; consultants selling SOC 2 services externally; individuals without current exposure to control documentation or audit cycles
What you walk away with
- Own the SOC 2 control mapping track from requirement to evidence package
- Develop defensible control narratives backed by standard wording and logic
- Build repeatable templates for common Trust Service Criteria
- Anticipate auditor questions and pre-empt follow-ups with complete artefacts
- Become the internal reference others consult on control design choices
The 12 modules (with all 144 chapters)
Module 1. SOC 2 scope assessment fundamentals
Understand how to define system boundaries and identify in-scope components for Type I and Type II reports with precision.
12 chapters in this module
- What defines a system boundary
- Identifying in-scope services
- User roles and responsibilities
- Data flows and dependencies
- Distinguishing Type I and Type II
- Common scope exclusion errors
- Mapping systems to criteria
- Vendor subsystem inclusion
- Internal vs external access
- Physical and logical security layers
- Determining multi-location coverage
- Documenting scope statements
Module 2. Trust Services Criteria unpacked
Break down each of the five TSC categories with real-world control examples and implementation patterns.
12 chapters in this module
- Security principle breakdown
- Availability reporting norms
- Processing integrity expectations
- Confidentiality scope boundaries
- Privacy framework alignment
- TSC vs compliance frameworks
- Control overlap identification
- Criteria-specific evidence
- Mapping TSC to NIST CSF
- Common auditor checklists
- Regulatory crosswalks
- Industry-specific benchmarks
Module 3. Control design for common gaps
Learn proven patterns to close typical control deficiencies before audit review begins.
12 chapters in this module
- Access review frequency rules
- Password policy enforcement
- Change management tracking
- Incident response documentation
- Backup verification methods
- Encryption implementation scope
- Logging coverage thresholds
- Third-party risk workflows
- Vendor review timelines
- Segregation of duties models
- Privileged account controls
- Remote access logging
Module 4. Control narrative writing
Write clear, concise, and auditor-ready control descriptions that require no follow-up.
12 chapters in this module
- Control statement structure
- Present tense for current state
- Including process owners
- Specifying frequency clearly
- Defining scope boundaries
- Linking to policies
- Using standard terminology
- Avoiding ambiguous verbs
- Referencing tools in use
- Documenting manual checks
- Automated controls wording
- Evidence retention periods
Module 5. Evidence collection planning
Plan and execute evidence collection that covers all Trust Service Criteria without over-collecting.
12 chapters in this module
- Monthly access reviews
- Quarterly attestation cycles
- Annual policy sign-offs
- Change log sampling
- Patch deployment records
- Vulnerability scan outputs
- Penetration test reports
- Backup success logs
- Encryption validation checks
- Incident response playbooks
- Disaster recovery test results
- Asset inventory snapshots
Module 6. Policy drafting for SOC 2
Draft actual policy documents that satisfy auditor expectations and align with control design.
12 chapters in this module
- Acceptable use policy clauses
- Password complexity standards
- Remote access rules
- Data handling classifications
- Incident reporting timelines
- Breach notification procedures
- Vendor due diligence steps
- Onboarding checklists
- Offboarding automation
- Data retention schedules
- Encryption requirements
- Audit logging scope
Module 7. Vendor risk integration
Incorporate third-party service providers into the SOC 2 framework with proper coverage.
12 chapters in this module
- Defining vendor scope
- Subservice organization types
- Right to audit clauses
- Third-party assessment timing
- SSAE 18 coverage thresholds
- Attestation dependencies
- Vendor control mapping
- Inherited controls logic
- Complementary controls note
- Auto-renewal tracking
- Risk tiering models
- Documentation collection workflow
Module 8. Audit readiness workflows
Structure internal processes to stay continuously audit-ready without last-minute scrambles.
12 chapters in this module
- Control owner assignments
- Monthly evidence check
- Quarterly control testing
- Remediation tracking
- Change freeze timelines
- Pre-audit walkthroughs
- Evidence folder structure
- Version control methods
- Stakeholder alignment
- Auditor communication plan
- Follow-up tracking
- Post-audit closure steps
Module 9. SOC 2 Type I vs Type II focus
Differentiate reporting requirements and evidence depth between report types.
12 chapters in this module
- Design effectiveness focus
- Operating effectiveness testing
- Point-in-time vs period
- Control operation duration
- Evidence collection length
- Attestation wording differences
- Management assertion scope
- Auditor testing depth
- Remediation timing
- Report distribution rules
- Renewal cycle planning
- Gap analysis before Type II
Module 10. Common findings and how to avoid them
Study real audit findings and learn how to prevent recurrence through design.
12 chapters in this module
- Incomplete access reviews
- Missing evidence samples
- Undefined control frequency
- Untested BCP plans
- Unverified backups
- Overdue risk assessments
- Undocumented changes
- Lack of encryption
- Inconsistent policy enforcement
- Expired attestations
- Poor vendor oversight
- Inadequate incident logging
Module 11. Control automation feasibility
Identify which controls can be automated and how to justify tooling investments.
12 chapters in this module
- Monitoring threshold rules
- Automated access reviews
- System-generated reports
- SIEM alert integration
- Ticketing system workflows
- Password rotation scripts
- Change detection tools
- Compliance dashboards
- Audit trail exports
- Automated validation checks
- Tool coverage mapping
- Cost-benefit analysis
Module 12. Becoming the internal reference
Position yourself as the trusted source on SOC 2 design decisions and narrative consistency.
12 chapters in this module
- Building internal credibility
- Documenting reusable templates
- Sharing control patterns
- Mentoring junior staff
- Standardising wording
- Creating playbook libraries
- Hosting internal reviews
- Responding to peer questions
- Updating for new regulations
- Maintaining version history
- Cross-team alignment
- Owning the control narrative
How this maps to your situation
- New SOC 2 project kickoff
- Midway through control documentation
- Preparing for auditor fieldwork
- Post-audit gap correction
Before vs. after
Before
Reliant on others for control design decisions and narrative structure
After
Go-to reference for SOC 2 control mapping and documentation across teams
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed to be completed alongside active work cycles.
If nothing changes
Without clear ownership of control design, practitioners remain task-completers rather than recognised contributors, missing the chance to shape compliance outcomes and gain visibility.
How this compares to the alternatives
Unlike generic compliance courses, this program focuses exclusively on SOC 2 control execution with templates and examples used by practitioners at firms like the firm, the firm, and the firm.
Frequently asked
Who is this course for?
Practitioners contributing to SOC 2 audits who want to move from task execution to owning control design and narrative quality.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this cover ISO 27001 as well?
No, this course focuses exclusively on SOC 2 Trust Services Criteria and control implementation.
$199 one-time. Approximately 3 hours per module, designed to be completed alongside active work cycles..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours