Skip to main content
All CollectionsFrameworksSOC 2 2017
SOC 2 Checklist
SOC 2 Checklist
Updated over a week ago

We recommend completing the following checklist in sequential order as you work towards your SOC 2 audit. The items listed below are applicable after you have successfully connected your systems in Drata:

  1. Fill in your Company Information

  2. Ensure all relevant policies for SOC 2 are drafted, reviewed and approved in your Policy Center

  3. Invite your employees to Drata to complete their onboarding process:

    1. Device Compliance

    2. Background Check (SOC 2 Background Check FAQs)

    3. Policy Acceptance (Policy Acceptance Grouping: Who needs to accept what policy?)

    4. Security Awareness Training

  4. Scope out your Trust Services Criteria (SOC 2 Trust Services Categories Overview)

  5. Complete Risk Assessment / Risk Management sections.

    1. Risk Assessment

      1. Risk Assessment Simplified - resource that you can use to simplify the formally-written questions

      2. Risk Assessment Results and Treatment Plan - resource that you can use to guide you through Sections 4 and 5

    2. Risk Management - this is an add-on feature in Drata to allow you to track Risks within the platform

  6. Download the Risk Assessment Report (and Risk Treatment document for Risk Management Module) and upload to:

    1. DCF-16: Annual Risk Assessment

    2. DCF-17: Remediation Plan

  7. Get Monitoring Tests to 100% (Please note: All Monitoring Tests have a Learn More button that will take you to a Help Article which will give you more information and provide remediation steps)

  8. Upload Evidence for Not Monitored Controls referencing our suggested Example Evidence for Not Monitored Controls

    1. SOC 2 Type 1 - we recommend to upload evidence before your actual audit date

    2. SOC 2 Type 2 - we recommend verifying with your auditor when you can upload evidence. More than likely, your auditor will prefer you upload evidence during your observation period.

    3. Note: Please ensure that evidence are uploaded to controls that may show as ready while only linked to an approved policy in Drata (Example Evidence for Not Monitored Controls Linked to Policies)

  9. Include all Key Vendors in your Vendors module (How to Determine Key Vendors to include in Drata)

    1. Perform Vendor Compliance Report Review by following our guidance on Reviewing Your Vendors' SOC 2 Reports Using Drata

    2. If your vendor does not have a SOC 2 Report, but provided their ISO 27001 Certificate, you can use our alternate ISO 27001 Certification Review Template

    3. If your vendor does not have any Compliance Reports, you can send them a Vendor Security Questionnaire

  10. Select your SOC 2 Auditor via Drata’s Auditor Directory. You can interview your potential SOC 2 Auditor using our guidance on what Questions to ask a potential SOC 2 auditor

    1. Important Note: You can engage at any point with an auditor and is a step we recommend as most control-specific questions are better answered by the auditor Optional: You can discuss a Readiness Assessment with your SOC 2 Auditor to provide extra assurance before the actual audit.

  11. Select your Audit Date

  12. Reach out to your Customer Success Manager to schedule a Pre-Audit Check-in

  13. Set up Audit Hub and invite your Auditors

  14. Complete your SOC 2 Audit

  15. Reach out to your Customer Success Manager and let us know the great news!

Did this answer your question?