SOC 2 Consulting Services
Readiness, Implementation, Audit and Program Management

Phase I - Scope of SOC 2 compliance

Scoping involves the identification of:

• Identification of sensitive data and its flow including lifecycle
• Information systems in scope
• Business locations
• Data Center and Cloud Services Providers
• Users of the report

Phase II -Gap Analysis and Risk Assessment

Based on the outcome of phase I, a combination of approaches is applied by Coral SOC 2 consultants to conduct the gap analysis.

• A session with each organization team to asses their current scope of work and their controls
• Determination of applicable, and not applicable controls
• Detail risk assessment based on the flow of the information
• A status of each control requirement in red, orange and green - determining their current status.

Coral consultants will provide detailed recommendations for each identified gap with their recommendations

Phase III - Design, Documentation and Risk Monitoring

• Design involves control allocation responsibility to organization stakeholders.
• Documentation involves drafting 20+ policies and procedures and facilitating their implementations
• Risks identified in the gap analysis are discussed in detail along with their treatment plans.

Phase IV - Training & Brainstorming Sessions

• SOC 2 requires employees' involvement in defining their internal security controls.
• This is achieved by a combination of training and brainstorming sessions.
• Each documentation or risk undergoes brainstorming with staff to derive a ‘best-fit’ solution for the organization.

Phase V - Control Testing

After the policies and risks are mitigated, depending upon client report requirements, controls are tested for a period of time.

• For instance, at least a month of testing is required for Type 1, whereas for Type 2, anywhere between 3 to 6 months of testing is required.
• Coral consultants assist the client in testing these controls to ensure the designed controls are not only defined well but are also effective.

Phase VI - Internal Audit and Management Review

• Internal Audit involves verifying the effectiveness of the implemented lifecycle controls through interviews with physical and system verification of applicable controls, as it applies to the organization control design.
• A formal report is published for the management committee.
• We facilitate reviews with the management to ensure that the initial SOC 2 policy objectives and goals are achieved.

Summary

At this stage:

• As a result of undergoing these phases, Coral has assisted the client in a successful governance program that is now compliant with SOC 2 requirements.
• Each of the applicable SOC 2 requirements has been completed by a combination of one or more of policy, responsibilities, reports, records, technology, and automation.
• The organization now has a plan that demonstrates its continued commitment like any other business function
• At this stage, the organization is ready to invite a CPA firm to perform an independent assessment.

Phase VII - CPA Attestation

The chosen CPA firm performs an audit, which includes the following phases:

• Documentation Review
• Interviews
• Testing control effectiveness

Once the CPA firm is satisfied with the completeness of the controls, a format report is issued to the client detailing the controls being tested with their test result

At this stage, the client is officially SOC 2 attested.

Questions

Seek a one to one session with our Principal Consultant, who will answer your questions to get started.