Compliance
Run your SOC 2 program: readiness, controls and evidence, policies, automated tests, and the risk and vendor registers.
Compliance holds your SOC 2 program. Adopting it adds the controls an auditor checks, mapped to the Trust Services Criteria, the automated tests that check your systems, a starter risk register, and a draft of each policy in the Library.
Readiness is the share of in-scope controls that are implemented. A control marked not applicable needs a reason and is left out of the count.
How to
- 1
Adopt SOC 2 and answer the questions about your company, systems and commitments.
The answers are written into the policy drafts, so name your real cloud, identity provider and owners. Security is always in scope; add the other categories your customers ask for.
- 2
On Controls, give each control an owner, say how it is implemented, and attach evidence.
Evidence can be a link or a note. Set a control to not applicable only with a reason an auditor would accept.
- 3
On Policies, open each policy in the Library to review the draft, get it approved and assign it for acknowledgment.
- 4
Keep the risk and vendor registers current, and mark each one reviewed when you have looked at it.
- 5
Set the observation window on Program before a Type II audit starts.
If something goes wrong
- There is no Adopt button.
- Adopting a framework needs the “Adopt a framework, change program settings & automated tests” permission. Ask an org admin for it.
- The Policies tab says I need a library permission.
- Policies live in the Library. Ask an org admin for a library permission, such as reading approved items.
- Acknowledgment counts show a dash.
- Seeing everyone’s acknowledgment status needs the acknowledgments permission. Each person still sees their own under My acknowledgments.