SOC 2 Readiness & Implementation

What you will be able to do

• You will be able to distinguish SOC 1, SOC 2, and SOC 3 reports and choose between Type I and Type II for your situation.
• You will be able to explain the five Trust Services Criteria and decide which to include in scope.
• You will be able to define the boundaries of the system being audited and write a clear system description.
• You will be able to run a gap assessment, map controls to criteria, and build a prioritized remediation plan.
• You will be able to design an evidence collection process that survives a Type II audit period.
• You will be able to identify and communicate complementary user entity controls (CUECs) and subservice organization controls.
• You will be able to prepare for and manage the CPA audit, including PBC requests and walkthroughs.
• You will be able to read a SOC 2 report and interpret the auditor's opinion, exceptions, and qualifications.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   SOC Report Foundations

   Understand the SOC report family and how it fits into the assurance landscape. Learn the difference between SOC 1, SOC 2, and SOC 3, and when to choose a Type I versus a Type II report.

   2 lessons · 5 quiz questions

2. 02

   Trust Services Criteria & Scoping

   Learn the five Trust Services Criteria in depth and how Security functions as the mandatory common baseline. Then learn to define the system boundary, select the criteria that fit your commitments, and write a defensible system description.

   2 lessons · 5 quiz questions · assignment

3. 03

   Gap Assessment & Control Implementation

   Run a structured gap assessment against the in-scope criteria, map controls to criteria, and build a prioritized remediation plan. Then learn to design and implement controls that will actually pass an audit.

   2 lessons · 5 quiz questions

4. 04

   Evidence, the Audit, and the Report

   Build an evidence process that survives the audit period and understand complementary user entity controls. Then learn how to work with the CPA auditor through fieldwork and how to read the final report, including the opinion and any exceptions.

   2 lessons · 5 quiz questions · assignment