Playbooks
Prepare for SOC 2
Choose the categories, assess, keep recurring evidence and show that controls hold over time.
Role: Compliance manager This playbook prepares a SOC 2 report. The app organizes the preparation; the report is issued by an independent auditor.
Before you start: app installed, compliance manager named, licence active.
1. Turn SOC 2 on and choose the categories
Screen: Frameworks.
- Turn on "SOC 2 (trust services criteria)". Security is always part of it.
- Pick the service categories: Availability, Confidentiality, Processing integrity, Privacy. They count in the score if you pick them. Click "Save frameworks".
Screenshot to come
2. Assess
Screen: Assessment. Tick SOC 2, answer, save: gaps become tasks in the action plan.
3. Add evidence, and renew it
- Add dated evidence per task or control.
- Evidence older than its frequency is stale: the control goes back to "Evidence to provide". An observation period is prepared by keeping evidence up to date.
4. Measure continuously
Screen: Tests and continuous monitoring.
- Fill in the watched projects, turn on monitors, save the settings, then "Evaluate now".
- A failing monitor puts the control that names it into "Test failing".
- Optional: a Jira ticket for each failing control, and e-mail reminders. Both are off by default.
5. Access, changes, incidents
Screens: Access reviews (playbook), Incidents (playbook), Vendors, People and training.
6. Hand over to the auditor
Screen: Audit pack. Edition: Advanced Generate the zip; follow requests in "External audit" of Audits.
What the app does not do
- It does not produce a SOC 2 report and does not say your controls were effective over a period.
- It does not question you in the auditor's place: the assessment is a preparation aid.
- It keeps only counts for monitors, never ticket keys or titles.
Was this page helpful?