SOC 2 compliance: a 10-step guide for mid-market companies.

• Systems and services: which products, infrastructure, and data stores handle customer data.
• Criteria: Security is required. Add others when customer contracts or your service call for them, for example Availability for a platform with uptime commitments.
• Boundaries: which teams, locations, and subservice organizations (like your cloud provider) are in or out.

Keep the scope as tight as your customers allow. Every added system adds controls, evidence, and audit cost.

Compare what you do today with the criteria. Check that security policies exist and are approved, that access is based on roles and reviewed, that there is an incident response plan, that changes are approved and tested, that systems are monitored, and that vendors are assessed. List each gap with an owner and a date. See gap assessment.

Mid-market companies most often need to add or tighten these controls:

• MFA and SSO for workforce access, with least privilege.
• Encryption of data in transit and at rest.
• Logging and alerting for production systems.
• A documented change management process with peer review.
• Vulnerability scanning with fix deadlines by severity.
• Vendor risk reviews for providers that handle customer data.
• Security awareness training at hire and every year.
• Background checks where the law allows.

Automate where you can. A control that runs through your tools, like branch protection or automatic account deprovisioning, produces evidence on its own and fails less often.

Auditors will ask for your policies and procedures and a description of your system. The core set is an information security policy, access control, change management, incident response, business continuity and disaster recovery, vendor management, data classification and retention, and acceptable use. Write them to match what you do, with owners and review dates. A policy that describes a process nobody follows creates an exception.

Before the auditor arrives, run a readiness assessment: test each control the way the auditor will, confirm evidence exists and is dated, and fix what is missing. Many companies do this with a consultant or a GRC platform. It is the cheapest point at which to find problems.

• Only a licensed CPA firm can issue a SOC 2 report.
• Look for experience with companies of your size and industry.
• Ask how they handle evidence requests and how much of the work is remote.
• Ask for references, a sample timeline, and a fixed fee for the scope.
• Check that the firm's report is recognized by the customers you sell to.

For Type II, the auditor samples evidence from across the observation period. Expect interviews with control owners, requests for lists (new hires, terminations, changes, incidents) from which they pick samples, walkthroughs of key processes, and inspection of system settings. Good organization matters here: evidence that is already dated and linked to each criterion shortens fieldwork.

Exceptions are common in a first report. For each one, agree on the facts with the auditor, write a management response that explains the cause and the fix, and track the fix to completion. Customers read exceptions, so a clear response and a fixed control matter more than a perfect first report.

SOC 2 continues after the first report. Most companies move to back-to-back 12-month periods, so controls have to run all year. Keep evidence current, re-run your readiness checks every quarter, train new hires, review vendors, and update the scope when you launch new products or systems.

TruOps pre-fills a SOC 2 readiness assessment from your documents, with a source behind every answer. It monitors technical controls through read-only connections to your cloud, identity, and code tools, keeps dated evidence for each criterion, and turns gaps into findings with recommended fixes. The same evidence maps to ISO 27001 and other frameworks, so your next framework starts partly done.