IT support for SOC 2 Type II readiness

Understand what a SOC 2 Type II report covers

SOC 2, one of the System and Organization Controls (SOC) reports, concerns controls assessed against the applicable Trust Services Criteria. A Type II report addresses how those controls operated over a period, not only how they were designed. Confirm with your customer or auditor that SOC 2 Type II is the report they need; SOC 1, a different report, concerns controls relevant to customers' financial reporting.

Define the supporting IT work

Discuss the controls your organization and examiner have identified, the systems involved, and the evidence needed. Relevant work may involve access management, system configuration, patching, security monitoring, backup procedures, and records of the agreed IT activities.

Maintain controls during the examination period

Readiness involves ongoing operation and useful records, not just a one-time configuration change. Agree on responsibilities, review dates, and the documentation needed to support the controls in scope. Confirm the examination period and timeline with your CPA firm.

Work with your independent CPA examiner

The CPA firm performs the examination and issues its report. PC NET TECHS supports the agreed technical work and records; it does not issue a SOC 2 report through this service.

Official guidance

AICPA & CIMA describe the System and Organization Controls reports and who performs them.

Common questions

Related pages

Other compliance support