To get SOC 2 Type 2 yourself, scope one system and its trust categories, implement controls mapped to the AICPA criteria, write and approve policies, run the controls for a defined period while collecting evidence, then hire an independent CPA firm to test them and issue the report. You prepare, the auditor opines.
The AICPA text says a Type 2 report covers a specified period and includes the auditor's opinion on operating effectiveness plus a description of the tests and results. A Type 1 covers design at a point in time. The criteria set no fixed length for the period, so agree it with your auditor. This plan is paraphrased from the 2017 Trust Services Criteria with 2022 points of focus.
Step 1: Decide why and who
Name an executive owner, a day-to-day coordinator and one owner each for engineering, people operations and IT. Confirm what customers ask for: report type, categories, timing.
Step 2: Scope
Choose the system, boundary and categories. Security (CC1 to CC9) is required. Add Availability, Confidentiality, Processing Integrity or Privacy only if customers need them. See our scoping guide for detail.
Step 3: Select the auditor early
SOC 2 reports are issued by an independent service auditor, which means a CPA firm. Talk to two or three, ask about the observation period they expect, evidence format, and how they treat vendors. Do this before you build, because their answers shape the work.
Step 4: Gap assessment
Walk each criterion and ask what you do today, what proof exists and what is missing. A simple sheet with criterion, control, owner, evidence and status is enough.
Step 5: Build controls
Group them by what the criteria cover:
- Governance and risk (CC1 to CC3): code of conduct, org chart, a risk assessment with scoring.
- Monitoring (CC4) and control activities (CC5): internal reviews, policies.
- Access (CC6): multi-factor authentication, role based access, joiner, mover and leaver steps, quarterly access reviews, encryption.
- Operations (CC7): logging, monitoring, vulnerability management, incident response with exercises.
- Change management (CC8): reviewed pull requests, tests, emergency path.
- Vendors and risk mitigation (CC9): vendor register and reviews.
Step 6: Write policies
Write short policies that match reality. Each needs an owner, approval date, review date and employee acknowledgement. A policy you do not follow becomes an exception.
Step 7: Collect evidence the right way
Evidence must be dated, attributable and generated during the period. Set a calendar of recurring items: access reviews, backup restore tests, vulnerability reviews, training, policy review, vendor review. Store each artifact where the auditor can reach it.
Step 8: Optionally get a Type 1
A Type 1 gives customers something sooner and tests your design. It is not required before a Type 2. Ask your auditor if it is worth the added fee for you.
Step 9: Run the observation period
Operate the controls and keep a monthly check: what ran, what slipped, what was fixed. Missed controls should be fixed and noted, not hidden. Auditors sample across the window, so consistency matters more than perfection on day one.
Step 10: Fieldwork and report
Expect evidence requests, walkthrough interviews and sample testing. You review the draft report, including management's description of the system, before it is final.
What to do
- Appoint owners and confirm customer requirements.
- Scope and pick an auditor.
- Do the gap assessment and build the fix list.
- Implement and document controls.
- Start the clock only when controls are in place and evidence is flowing.
- Run monthly checks through the period.
- Support fieldwork and review the draft.
Quick check
Can I skip Type 1 and go straight to Type 2?
Yes. A Type 1 is optional. Type 2 is a separate engagement over a period, and you can go straight to it if your customers accept that.
Can I issue the report myself?
No. The report is issued by an independent service auditor, who is a CPA or equivalent, after testing your controls.
How Safeguard helps automate this
The longest part of a DIY Type 2 is the observation period, where evidence has to keep arriving. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, saving the team time for other work. Technical evidence comes from your real code and dependencies, including scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. The independent auditor decides the outcome. Book a call to see it.
Open the framework mapping demo
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), read from a local copy on 18 October 2026
Last reviewed: 18 October 2026.
