SOC 2 Compliance Guide

📋 Compliance 25 min read Updated June 2026

SOC 2 (Service Organization Control 2) is the gold standard certification for SaaS companies and managed service providers. It proves to your clients that you have implemented rigorous controls to protect their data — and that those controls actually work over time. This guide covers everything your MSP needs to know, plus how Gridlock's Compliance Agent compresses a typical 6-month audit prep into 30 days.

What is SOC 2 and Who Needs It?

SOC 2 is a voluntary compliance framework created by the American Institute of Certified Public Accountants (AICPA). It evaluates whether a service organization has effective controls in place to protect the security, availability, processing integrity, confidentiality, and privacy of customer data.

While voluntary, SOC 2 has become a de-facto requirement for any business that stores, processes, or transmits customer data in the cloud. Enterprise procurement teams routinely gate vendor approvals on a current SOC 2 report. For MSPs, a SOC 2 Type II report is increasingly the difference between winning and losing mid-market and enterprise clients.

Organizations that need SOC 2

• Managed Service Providers (MSPs) — You touch client systems, data, and networks. Your clients' security teams will ask for your SOC 2 report.
• SaaS companies — Any product storing customer data in cloud infrastructure.
• Healthcare IT vendors — Often required alongside HIPAA. SOC 2 + HIPAA is the standard dual-framework stack.
• Financial services vendors — Especially when SOC 1 does not apply (no financial reporting impact).
• Government contractors — SOC 2 is frequently cited in RFPs as an acceptable baseline before FedRAMP.
• Data processors and analytics firms — Any organization where data handling is a core service.

The 5 Trust Services Criteria

SOC 2 is organized around five Trust Services Criteria (TSC). Security is the only required criterion — the remaining four are selected based on what is relevant to your service commitments and system requirements.

Which criteria should MSPs include?

For most MSPs, the recommended scope is Security + Availability + Confidentiality. This covers the three areas that enterprise procurement teams care most about and matches the standard MSP service commitment profile. Processing Integrity is only relevant if you operate financial systems; Privacy becomes relevant when handling personal data subject to GDPR or CCPA.

Criterion	Relevant For MSPs	Gridlock Coverage
Security (CC)	Always — all MSPs	Automated
Availability (A)	If you provide uptime SLAs or managed infrastructure	Automated
Confidentiality (C)	If you handle confidential client data	Automated
Processing Integrity (PI)	Only if you process financial transactions	Partial
Privacy (P)	If you handle personal data under GDPR/CCPA	Partial

Key Security (CC) control domains

The Security criterion is organized into Common Criteria (CC) categories. Understanding these helps you map your existing controls and identify gaps:

• CC1 — Control Environment: Governance, code of conduct, board oversight, organizational structure, commitment to competence.
• CC2 — Communication and Information: Internal/external communication about controls, security policies.
• CC3 — Risk Assessment: Identifying, analyzing, and managing risks to achieve objectives.
• CC4 — Monitoring Activities: Continuous monitoring, deficiency evaluation, corrective action.
• CC5 — Control Activities: Policies, procedures, technology controls to mitigate risks.
• CC6 — Logical and Physical Access Controls: MFA, access provisioning/deprovisioning, least privilege, physical security.
• CC7 — System Operations: Vulnerability management, incident detection and response, malware protection.
• CC8 — Change Management: SDLC, code review, deployment controls, change authorization.
• CC9 — Risk Mitigation: Vendor management, business continuity, insurance.

Type I vs Type II — Key Differences

There are two varieties of SOC 2 report. Understanding the difference is critical for setting client expectations and planning your audit timeline.

Attribute	SOC 2 Type I	SOC 2 Type II
What it proves	Controls are designed appropriately at a single point in time	Controls are designed appropriately and operating effectively over a period of time
Audit period	Single day (point-in-time)	Minimum 6 months; typically 6–12 months
Time to obtain	2–4 months total	6–14 months total (includes observation period)
Client acceptance	Accepted by some; many enterprise buyers require Type II	Gold standard; accepted by all enterprise procurement teams
Auditor testing	Design evaluation only	Design evaluation + operating effectiveness testing with samples
Evidence required	Policies, procedures, configuration screenshots	All of the above + months of log data, access reviews, change records, incident records
Cost	$15,000–$30,000	$30,000–$80,000
Renewal	One-time (bridged with Type II)	Annual renewal

How Gridlock's Compliance Agent Maps to SOC 2 Controls

Gridlock's Compliance Agent was built with SOC 2 Trust Services Criteria as a first-class design target. Every major control category has automated monitoring, evidence collection, and gap alerting.

SOC 2 Control Category	What Gridlock Monitors	Evidence Type
CC6 — Access Controls	MFA enforcement status, privileged account inventory, access reviews, account deprovisioning timeliness, SSH key management	Configuration exports, access logs, review records
CC7 — System Operations	Vulnerability scan results, patch deployment status, antimalware coverage, intrusion detection alerts, incident response records	Scan reports, patch deployment logs, alert history
CC8 — Change Management	Change ticket compliance, deployment authorization records, configuration drift detection, code review completion rates	Change records, approval logs, drift reports
CC3 — Risk Assessment	Risk register currency, risk scoring trends, third-party vendor risk ratings, emerging threat mapping	Risk assessment reports, vendor scorecards
CC4 — Monitoring	SIEM alert triage rates, anomaly detection coverage, control effectiveness metrics, exception reporting	Monitoring dashboards, exception logs
CC9 — Vendor Management	Vendor contract inventory, SOC 2 report currency for subprocessors, vendor risk questionnaire status	Vendor inventory, report expiry tracking
A1 — Availability	Uptime metrics, SLA compliance, capacity utilization, DR test results, backup verification	Uptime reports, DR test records, backup logs
C1 — Confidentiality	Encryption at rest and in transit, data classification coverage, secure disposal records, NDA tracking	Encryption configuration exports, disposal records

Evidence Collection Automation

The most time-consuming part of a SOC 2 Type II audit is not the audit itself — it is the evidence collection. Auditors request hundreds of pieces of evidence: screenshots, configuration exports, log samples, policy documents, access review records, and more. Without automation, this burden falls on your engineers and compliance team for weeks.

What Gridlock auto-collects

Evidence Category	Examples	Frequency
Access control evidence	MFA enrollment reports, privileged user lists, access review completion logs, terminated employee deprovisioning records	Daily
Vulnerability management	Scan results with severity breakdowns, patch deployment records, open vulnerability aging reports, remediation timelines	Weekly
System configuration	Firewall rule exports, encryption settings, logging configuration, endpoint protection coverage maps	On change + weekly snapshot
Incident records	Security incident log with detection time, response time, resolution, and post-incident review records	Continuous
Change management	Change request records with approver documentation, emergency change log, deployment records	Per-event
Availability metrics	Uptime reports per system, SLA breach records, capacity trending, backup success/failure logs	Daily
Policy acknowledgments	Employee security policy sign-off records, security training completion certificates	Annual + on hire
Vendor management	Third-party subprocessor inventory, current SOC 2 report links, vendor assessment completion dates	Quarterly

The 30-Day Readiness Timeline

A traditional SOC 2 readiness engagement (before auditor engagement) takes 3–6 months with a consulting firm charging $50,000–$150,000. Gridlock compresses this to 30 days by automating the gap assessment, evidence collection setup, and control mapping.

What the SOC 2 Audit Process Looks Like

Understanding the audit mechanics helps you know exactly what to prepare and what your auditor will do. A SOC 2 audit is conducted by an independent CPA firm licensed to perform SOC examinations (not all CPA firms qualify).

Phase 1: Engagement setup (weeks 1–2)

You and the auditor agree on scope (which Trust Services Criteria, which systems), the observation period (for Type II), and the audit timeline. The auditor provides an initial request list — this is where Gridlock's evidence packages save the most time.

Phase 2: Fieldwork (weeks 2–8 for Type I; weeks 2–16 for Type II)

The auditor reviews your documentation, tests your controls, and may conduct interviews with your team. For Type II, the auditor samples evidence from throughout the observation period — for example, reviewing 25 randomly selected change tickets to verify your change management process was followed consistently. Gridlock's continuous evidence collection means every one of those samples is immediately available.

Phase 3: Findings review (weeks 1–2)

The auditor presents draft findings. If exceptions are noted, you have an opportunity to provide management responses — explaining context or compensating controls. Gridlock's exception tracking makes it easy to demonstrate remediation timelines.

Phase 4: Report issuance

The final SOC 2 report is issued. It includes the auditor's opinion, your system description, and (for Type II) the test of controls with any exceptions noted. This report is what you share with clients and prospects under NDA.

Common MSP Client SOC 2 Questions

Your clients will have questions. Here are the most common ones, with answers you can use directly.

SOC 2 Readiness Checklist

Use this checklist to track your SOC 2 readiness. Click each item to mark it complete.

Scope and governance

• Define scope — Identify all systems, services, and data in scope for SOC 2
• Select criteria — Decide which Trust Services Criteria to include (minimum: Security)
• Appoint owner — Designate a compliance owner or team responsible for SOC 2
• Select auditor — Identify and engage a qualified CPA firm for the examination
• Set timeline — Establish Type I target date and Type II observation period start

Policies and documentation

• Information Security Policy — Approved, distributed, and acknowledged by all employees
• Access Control Policy — Defines least privilege, MFA requirements, access review process
• Change Management Policy — Covers authorization, testing, deployment, emergency changes
• Incident Response Policy — Detection, response, notification, and post-incident review
• Business Continuity Plan — Recovery objectives, backup strategy, DR test schedule
• Vendor Management Policy — Third-party assessment process, subprocessor inventory
• Acceptable Use Policy — Employee device and data handling rules

Technical controls

• MFA enforced — Multi-factor authentication required for all systems, especially privileged access
• Encryption at rest — All stored data encrypted (AES-256 or equivalent)
• Encryption in transit — TLS 1.2+ enforced on all connections
• Centralized logging — All systems log to a centralized SIEM with tamper-evident storage
• Vulnerability scanning — Regular automated scans with documented remediation SLAs
• Endpoint protection — EDR deployed with full coverage visibility
• Backup and recovery — Automated backups with tested restoration procedures
• Access reviews — Quarterly access reviews completed and documented

Gridlock automation

• Connectors deployed — Gridlock connected to all in-scope systems
• Evidence collection active — Automated evidence gathering running for all control families
• Gap alerts configured — Compliance Agent alerts firing on control deviations
• Control dashboard reviewed — All control statuses reviewed and exceptions documented
• Evidence package tested — Sample PBC package generated and reviewed for completeness
• Continuous monitoring active — Ongoing monitoring running for the full Type II observation period

Related Resources