SOC 2 Type II: Beyond Point-in-Time
While SOC 2 Type I evaluates control design at a specific date, Type II examines whether controls operated effectively over a period (typically 6-12 months). This makes Type II significantly more challenging and valuable.
Trust Service Criteria
Security (Common Criteria)
The foundation. Controls protecting against unauthorized access:- Firewalls and network security
- Access management and authentication
- Vulnerability management
- Incident response
Availability
System availability meets agreed-upon commitments:- Uptime monitoring and SLAs
- Disaster recovery and backup
- Capacity planning
- Incident communication
Processing Integrity
System processing is complete, accurate, and timely:- Input validation
- Error handling
- Data reconciliation
- Processing monitoring
Confidentiality
Information designated as confidential is protected:- Data classification
- Encryption
- Access restrictions
- Secure disposal
Privacy
Personal information collection, use, and retention follow stated policies:- Privacy notices
- Consent management
- Data subject rights
- Data retention policies
Preparation Timeline
Months 1-2: Readiness Assessment
- Select Trust Service Criteria
- Gap assessment against SOC 2 requirements
- Remediation planning and resource allocation
Months 3-4: Control Implementation
- Deploy missing technical controls
- Document policies and procedures
- Implement evidence collection mechanisms
Months 5-6: Evidence Collection Begins
- Start the observation period (audit window)
- Collect evidence continuously
- Conduct control testing
Months 7-10: Observation Period
- Maintain controls consistently
- Document exceptions and remediation
- Prepare evidence packages
Months 11-12: Audit
- Auditor performs testing
- Address any identified gaps
- Receive SOC 2 Type II report
Evidence Collection Tips
- Automate evidence collection wherever possible
- Use screenshots with timestamps for manual processes
- Maintain a central evidence repository
- Map evidence to specific control criteria
SuperClue SOC 2 Module
SuperClue's SOC 2 framework scan runs 13 checks across the Trust Services Criteria. It checks your external website and asks for evidence where a control cannot be seen from outside, which helps you find gaps before your auditor does.