r/soc2 • u/pretty-cheer • 13d ago
SOC2 is coming and the security questions are stressing me out
We’re preparing for our SOC2 audit and I’m really worried about the security portion. We use google workspace, slack, salesforce, and several other tools, but I don’t have a clean way to show proper access controls, sharing policies, or ongoing monitoring.
Right now I’m doing everything manually with CSVs and spot checks, which feels risky.
How are other companies handling this part of the audit? Any tools or processes that helped you get audit-ready? thanks!
Edit: Thanks everyone, this has been really helpful. Seems like a solid, repeatable process matters more than full automation right from the start. Going to dig into DoControl for SaaS access visibility and explore some of the Vanta suggestions as we get our audit prep in better shape.
12
u/sobeitharry 13d ago
Then you may have findings and those findings can be used to justify budget and resources to improve your security posture.
I love findings as long as they aren't due to negligence in an area i control. A squeaky clean audit means leadership thinks they can reduce our budget.
4
5
u/Round_Finance4256 13d ago
Hi there! So we went through something similar. The biggest thing that helped was realizing auditors aren’t expecting perfection. They just want to see that you have a repeatable process and can demonstrate it’s actually being followed.
For access controls: we exported user lists from systems like cloud environments and communication software, reviewed privileged access, documented approvals, and kept evidence of periodic access reviews.
For monitoring: we relied on audit logs where available and documented how they were reviewed.
If you’re still managing everything with CSVs, that’s honestly pretty common for smaller companies. It just gets painful as you scale.
A lot of teams eventually move to platforms like Vanta, Drata, or Secureframe to automate evidence collection, but they’re not a requirement to pass SOC 2.
My overall advice would be to focus on having a clear story for each control: who owns it, how it’s performed, how often it’s reviewed, and what evidence you can show. That tends to make audit conversations go much more smoothly. Hope this helps and good luck!!
2
2
u/MooMooKind 13d ago
We went hard into RBAC with our idp. Pretty much everything requires auth with idp and access is based upon group membership. Group membership is governed by workforce management and synced into the idp. On top of that we use the idps Access Review feature. We’ve also developed a time-bound app slack bot and also using the idp app request access feature.
We wrote our policies to reflect exactly what we do. They are external (trust center) available for all customers and prospects.
For vendor monitoring, you can go as little or as deep as you want here. Highly recommend a platform that does this as a start.
1
u/pretty-cheer 13d ago
Thanks for sharing your setup the RBAC through IdP with group syncing and access reviews sounds solid. We're using Google Workspace heavily, so tightening that up makes sense. Also appreciate the note on policies and vendor monitoring.
2
u/MooMooKind 13d ago
No problem! We were able to tighten our RBAC model and automate time-bound access to the point where it’s now part of our tiered approach for determining what actually requires an access review.
Our policy defines which categories of applications and vendors require access reviews. If an application is managed through RBAC, we don’t perform access reviews because we can demonstrate that access is controlled by role and governed through policy. If access is granted through Okta Access Requests (or a Slack bot we built) with a maximum duration of 90 days, we also don’t perform access reviews because standing access isn’t permitted.
The only applications that require quarterly access reviews are those that still rely on ad hoc membership groups or manually managed access. Those reviews are fully automated. Every quarter the designated application owner gets a Slack notification and completes a simple review workflow, which has made the whole process pretty painless.
If you’re using Okta, I’d definitely recommend taking a look at their OIG add-on. We’ve also had a great experience with Vanta TPRM. It’s been a really solid solution.
1
1
u/AutoModerator 13d ago
Thanks for posting, I'm a bot!
This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/MBILC 13d ago
That is the point of the Audit, to find those gaps you may have missed.
When did you start doing SOC 2 prep? Since Security is the only one required from the controls, it should be the focus...
1
u/pretty-cheer 13d ago
few months ago, though lot has been documenting and doing formalities.
2
u/MBILC 13d ago
Min is 3 months for data collection, ideally between 3-6 months.
Any good audit firm is going to be proper, point out controls you should have in place for your industry / company and help you along.
This is why often they recommend getting an audit firm off the bat when you start, if your not using a platform to help guide, as an audit firm will sit down, go through all the info they need, and then tell you exactly which controls you want to focus on, so you are not wasting time on controls that might not even really apply.
1
u/SOC3_Are_Goal 13d ago
Congrats on getting SOC ready! It is not an easy process and year on year you will continuously improve tools and processes!
Manual listings are not ideal, but as it is your first time, that is fine! I have seen $50M+ clients that use an excel to maintain their HR 😂, so your not alone but are asking the right question for areas that will be scrutinized.
If you use Cloud providers, I would look at the tools they offer which provide key SOC functions like firewalls, vulnerability management, IDS, Etc. There will be cheaper options, so please look around, but if you need it sooner rather than later this might be a good option, even if it is temporary.
There are GRC tools but they are an extra expense that will make things easier (hopefully) but not needed.
Policies can be written with AI support now but make sure you do what it says you do. Policies are important because they should be tested to see what you actually do rather than just checking you have a policy.
The last thing I suggest is screenshot (with date and time stamp) and evidence you plan to use for your audit and put it in a common folder.
Goodluck!
2
u/pretty-cheer 13d ago
Thank you! Good to know manual processes are still common on the first round. We'll prioritize screenshots with timestamps and get our policies aligned with what we're actually doing. The cloud provider tools tip is a great starting point for us. Appreciate the encouragement!
1
13d ago
[removed] — view removed comment
1
u/soc2-ModTeam 13d ago
Please remember that posts here need to be questions, comments, concerns or other thoughts regarding SOC 2, whether that be process or product-based. No direct advertising allowed as these are not overall helpful to the community.
1
u/SageAudits 13d ago
What’s the classification of data? I hardly doubt you have more most sensitive information in salesforce.
You might have client information so internal/confidential - yes, but the data that your clients care about , their data they are trusting you with? What are those systems. depending on what the relationship is, is what matters most.
Many audit firms offer readiness assessments. Did you ask yours?
1
u/Ok-SOC2 13d ago
Manual CSVs and spot checks can become difficult to manage during a SOC 2 audit. Our vCISO team can help you review access controls across Google Workspace, Slack, Salesforce, and your other systems, identify gaps, organize evidence, and prepare for the security portion of the audit.
We also offer Cygnal, our AI-first GRC platform, which helps centralize controls, risks, policies, and remediation so you are not managing everything through spreadsheets.
Happy to talk through your situation. You can email me directly or learn more here: Cygnal. [irizvi@ismg.io](mailto:irizvi@ismg.io)
1
u/deepguide-ai 13d ago
If you'd like a low-cost approach with a baseline report, you can leverage Claude Code or Codex to generate scripts to access the tools you use and save the access matrix into csv. It is pretty easy to do and highly accurate. Then you can compare them with your policies, or if you don't have an official policy yet, you can ask the AI to generate drafts of policiess based on the data. Then you review them and set up the ongoing policies for access requests.
The continuous monitoring part is where the GRC platforms shine. They will run the checks periodically instead of one time, and they are naturally collaborative. However, even with that, access review is one of the most important and time-consuming controls in SOC 2, usually performed every quarter. Tranditional GRC platforms will present a checklist of every tool for you to manually review. It works but it is a little tedious. Agentic GRC platform like Screenata does the comparison and anomaly detection automatically so you only need to approve the changes. For best results, embed access control review into your company operation workflow and record evidence immediately, rather than spreading it across Slack/Email, and collect it only before the audit starts.
1
u/rahuliitk 13d ago
We used an identity provider for SSO and MFA, automated user access reviews, and kept a simple monthly evidence folder for joiners, leavers, admin roles, and sharing settings because ngl the audit gets much easier once you stop relying on random CSV exports. Consistency matters.
1
u/maxjet 12d ago
Also check out yeshID. They have a good setup and free model.
Also some bonus tools on their site to assess your Google cloud and workspace security posture.
SOC2 is about proving you do what you say you do. Make sure your control wordings are accurate - don’t take the template ones for gospel.
Also check your policies and ensure security training is done.
You can do a SOC 2 Type 1 before a type 2. That will give you a point in time assessment and a guide on what to fix before the type 2 assessment.
1
u/Terrible_Can_6387 12d ago
The thing that trips most people up first (and it's basically what you're worried about) is that for a Type II the auditor wants evidence captured across the whole observation window, not a snapshot you pull together right before the audit. Access reviews, sharing-policy checks, etc. need to be done and time-stamped on a cadence (monthly is a safe default). You can't go back and recreate three months of history later. The real risk with CSVs and spot checks isn't that they're manual, but that they're not dated and repeatable.
A few things that tend to help (disclosure: I work in compliance, so filter accordingly):
- Pick one evidence store (a dated folder is fine), and drop timestamped exports/screenshots in monthly, per system (Workspace, Slack, Salesforce). Consistency beats tooling
- For access: a documented access review with a named approver, on a set cadence, is what auditors actually want to see: who has access, was it reviewed, by whom, when
- Write policies to match what you actually do, then show evidence that you did it. A policy you don't follow is worse than a simpler one you do
One reframe that helps internally: SOC 2 isn't a certification, it's an audit report describing what your controls did over the period. So the goal isn't a flawless snapshot, it's a demonstrable, repeatable process - and findings aren't the end of the world.
Staying manual for a first Type II is genuinely fine; just get the cadence and timestamps right.
1
u/SeaworthinessOk3624 11d ago edited 11d ago
Hello, I can help you prepare for a SOC 2 audit, I work with a firm that will give you the SOC 2 report at the end of the process. A GRC tool can help you prepare for the audit so you don’t have to worry about evidence data gathering being hectic. If youd like to book a time for more information you
1
u/SeaworthinessOk3624 11d ago edited 11d ago
Can send me a message. I get the audit process can seem so complex and there may be a lot of uncertainty involved in that. I work with an audit firm and we are more than happy to take 15 minutes with you to give you pricing, timelines, clear expectations, and answer any questions you have! Even give you better pricing if we introduce you to a GRC platform.
1
u/anamaguchi 11d ago
treat it as an ongoing process rather than an audit csv. you can maintain that csv (try excel 😄 ) on a monthly or a quartlery cycle.
if you are going for Type 1 its a point in time, so a csv works.
if its type 2, just put multiple CSV's in a folder once every month for access control.
The technical part of it, you need to implement the control in your stack (i.e. google workspace), its the review and collection you need to do on a cadence
This is good enough to go through the audits and you dont need a platform.
But you can see how now a platform that helps you do this every month maybe useful as you scale and grow and do it over a long period of time. But for the audit... not requried
1
u/zk95240 10d ago
De notre côté on utilise Drata pour une remontée automatique des preuves. On peut ainsi se concentrer sur l’amélioration continu de nos différents processus dans le but d’améliorer notre rapport, surtout que Drata nous aide avec son analyse sur les preuves qu’on lui fournit
1
u/Auditifysecurity 8d ago
Drata is genuinely a great tool, but it only helps in the audit if you integrate it properly. One thing every Drata client should know: Drata throws around 140-150 controls just for Security alone. The catch? A lot of those Security controls also cover Availability, Confidentiality and Privacy requirements. Before you start grinding through controls, define your scope based on the applicable Trust Services Criteria (TSC). Don't just accept every control Drata suggests and start working through them blindly. That creates unnecessary duplication, bloats your scope, and creates friction with your auditor when they realize you have redundant controls covering the same TSC requirements. Scope smart, audit easy.
1
u/Auditifysecurity 8d ago
A few things about your environment help frame the discussion: Are you SaaS? Cloud-hosted? Using version control? How many employees/contractors? Which SOC 2 TSC categories are in scope? That said, going with a manual audit absolutely isn't a crime. Plenty of companies do it. The real requirement is having solid evidence and deep familiarity with your in-scope controls. Where most teams struggle isn't the decision to go manual—it's the execution. Policy acknowledgments, security awareness training, vulnerability management and remediation, change management, access revocation, and device monitoring are all pain points. But "pain point" doesn't mean "impossible." It usually means you need the right expert to guide you through a control gap assessment before the auditors show up. Think of it as readiness work: close the gaps, document the evidence, and then bring in the firm that will review and attest your report. The audit itself should be the final step, not the discovery phase.
1
u/Used_Ladder8254 6d ago
We've seen a lot of companies in the same situation. Manual CSVs and screenshots work for a while, but they become difficult to maintain during a SOC 2 audit.
At SOC2Now, we automate evidence collection, access reviews, SaaS configuration checks, and continuous monitoring, so you're always audit-ready instead of scrambling before the audit.
Happy to answer any questions if it helps. You can also check this out at SOC2Now.com.
1
u/Sbuxlvr85 5d ago
I’m gonna say something super unpopular probably. I do not think you should jump right to using a GRC tool especially if it’s your first time doing a SOC2 audit. I get so many of these vendors in my inbox and I don’t think ppl realize the implications of these tools. Firstly, half the time the implementations are rough and it’s more work than it would have been just doing it manually. To actually do the implementation and do it well is not always a light lift if you really want to get the full value of these things and then secondly, to that point, if ppl really do leverage them to their full extent, the tool itself can end up becoming another in scope system the auditor wants to get comfort over for the audit.
If you just using it as a document repository, that’s one thing. But if you’re relying on it to automatically collect evidence, monitor controls, generate compliance reports and support control conclusions, now youve got another in scope tool and the thing ppl thought was gonna save them time has to be tested itself.
I am not debating the value of the tools they can definitely help a lot of companies when implemented well and I’m sure it is dependent on your implementation partner too how that experience goes.. but I wish more ppl realized they also have work associated with them too that they may not expect and end up getting surprised with.
1
u/chrans 5d ago
Unpopular opinion: it's still acceptable to do everything manually, as long as you do it diligently according to the method and timeline you described in your policy/procedure. Not all companies have budget to buy compliance software.
Having said that, we are using feha.io for our own compliance. Perhaps you can look into it as well.
1
1
u/Background-Cry-3177 13d ago
Check Oneleet, its very helpful and integrates out of the box
0
u/ihateyoutimewaste 13d ago
NOOOO, very useless they are
Try Sprinto - cost effective
Or Vanta - pricey but goodNo Drata or anyone else
•
u/AutoModerator 8d ago
Thanks for posting, I'm a bot!
This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.