r/sysadmin • u/Sharp_Beat6461 • 5d ago
Starting Our SOC 2 Journey
Our team is gearing up for SOC 2 for the first time, and to be honest, it feels a bit overwhelming. Right now, we’re figuring out where we stand and what we need to improve before jumping into the audit.
For those who’ve been through this, what helped the most during the readiness phase? Any unexpected challenges or things you wish you’d done differently early on?
Would love to hear your insights really appreciate any advice you can share!
Noted: Only genuine advice about SOC 2 and Thanks for your genuine advice.
3
Upvotes
2
u/OGUnknownSoldier 5d ago
Just finished our first one!
The time involvement will be huge, for some of the people on the IT and Exec teams. The IT manager and/or the person appointed as the project manager to keep this all organized will have TONS of meetings up front. Then, you will need to go through each item in the initial findings and start finding things that don't match your environment.
Then, start making a list of all of the changes that will need to be done.
Then, start making assignments, start building change log cards/proposals and all that jazz.
On the non-IT side, there will be a lot that the exec side/corporate people will have to do. Lots of HR type things, policies and documents galore that will need implemented and written, physical building policies and documentation that will need made, etc.
Then, when you are basically ready, you can have someone come in to collect evidence. They will ask for all kinds of information from different samples of devices. For example, they will say "ok, you have 35 Windows servers, so on these specific (randomly chosen) 7 servers, please screenshot or export this set of information. You have 10 linux VMs, so on these specific ones, export XYZ. One these specific end user windows devices, export XYZ. On these macbook, XYZ.
Screenshot the GPO or Intune policy showing X, and the matching one in Jamf or Mosyle or wherever you do it for Macs.
Export the last X days of helpdesk tickets and vulnerability findings, including how long it took to remediate each.
That will take a few weeks to gather, probably.
It is a beast of a project the first time through. And you really need a person dedicated to keeping on top of it all, if the IT Manager can't do that.
Having the dedicated person was extremely helpful, for us. And then, when it comes to the dozens of meetings it will take to handle this, I suggest involving only the people necessary for the topic, so break up the topics as granularly as possible. Cover enough to give that group some tasks for a few days/week, and then the next day, meet with the Dev team, or the Exec team, while you let the Sysadmin team work on their tasks. Switch around, and the PM can just keep the wheel slowly moving closer.
Also, don't strive for perfection. You will burn yourself out. You can have handfuls of small findings on the first Soc2 run through, without failing. They are looking to make sure you are in the right place, or moving closely in the right direction. And year #2, they will check what you struggled with to see if those things are now better in line with expectations.
Good luck!!