Let's Chat About SOC 2s, Baby

Wendy Knox Everette, a senior security advisor who helps startups build security programs, introduces SOC 2 as a voluntary audit that lets software and cloud providers show customers they maintain a baseline of security controls. She walks through the five trust services criteria, noting that security is the only mandatory one, and explains how confidentiality and privacy differ. She separates formal audits, which require a licensed CPA firm, from informal assessments, and points out that audits do not test technical flaws such as injection bugs, so a penetration test is still needed.

The middle of the talk covers building a custom control set and the areas auditors tend to examine: access control, change management that works in agile and CI/CD pipelines, patching timelines, risk registers, and recurring internal reviews. Evidence should come from systems that record who acted and when, and logs must be retained for the whole audit period. A Type 1 audit checks whether controls are designed correctly at a point in time, while a Type 2 audit samples items across a longer window, so starting with Type 1 is usually wise.

The closing section covers audit scope, which should follow wherever customer data lives, and choosing a firm that understands cloud technology and will work with your own control wording. Wendy suggests tracking evidence requests in Jira or spreadsheets rather than buying expensive governance software. The main takeaway is that a SOC 2 report reflects documented, repeatable processes rather than proof that a system is unhackable.