SOC 2 Type 2 Report Toolkit
A reporting playbook for service organisations preparing a SOC 2 Type 2 report across the trust services criteria and the audit period. Gerard Blokdyk prepares the playbook for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.
The playbook is typically around 65 files in 13 numbered folders, with a README that maps every file. Excel workbooks are about 60 percent and PDF guides about 40 percent. The playbook is prepared by Gerard Blokdyk for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.
What you get
13 numbered folders and a README that maps every file. It is a playbook, not training, and it does not include a certificate.
Who it is for
A reporting playbook for service organisations preparing a SOC 2 Type 2 report across the trust services criteria and the audit period. Gerard Blokdyk prepares the playbook for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.
The 12 areas
Area 1. Report scope and system description
- Define the trust services categories in scope
- Describe the system and its boundaries
- Name the report period
- List the complementary user entity controls
Area 2. Management assertion and auditor opinion
- Write the management assertion
- Define the auditor opinion
- Separate Type 1 from Type 2
- Plan the report date
Area 3. Control environment and governance
- Set control ownership
- Document policies and communication
- Define oversight and accountability
- Record the control framework
Area 4. Risk assessment
- Identify risks to the trust services criteria
- Assess likelihood and impact
- Link each risk to controls
- Review the risk assessment each period
Area 5. Monitoring activities
- Design monitoring for each control
- Set the test frequency
- Record exceptions and remediation
- Report monitoring results
Area 6. Logical access
- Provision and deprovision access
- Enforce authentication and authorisation
- Review privileged access
- Log and review access events
Area 7. System operations
- Run backup and recovery
- Manage capacity and performance
- Handle incidents and problems
- Protect against malware
Area 8. Change management
- Authorise changes before release
- Test changes
- Separate development from production
- Keep the change record
Area 9. Availability
- Set availability commitments
- Monitor uptime and incidents
- Test recovery objectives
- Record the availability evidence
Area 10. Confidentiality
- Classify confidential data
- Restrict access and disposal
- Encrypt confidential data
- Record confidentiality controls
Area 11. Privacy
- Map personal data flows
- Apply notice, choice and consent
- Handle requests and retention
- Record privacy incidents
Area 12. Evidence and period coverage
- Map each control to evidence
- Cover the full report period
- Keep samples and system exports
- Prepare the auditor request list
How it works
Prepared by Gerard Blokdyk for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.