SOC 2 Readiness Practitioner Certification

Common Criteria CC1 through CC5 are the governance and risk layer of the Security Trust Services Criterion. They map directly to the five COSO 2013 Internal Control components. This module walks each in turn, explaining what the criterion requires, what the 2022 Revised Points of Focus add, and what evidence the auditor tests.

Common Criteria CC1 through CC5 typically absorb 30 to 40 percent of the total control set for a first-time filer.

1. 1. CC1 Control Environment: tone at the top, board oversight, org structure 10 min
2. 2. CC2 Communication and Information: internal comms, external commitments, the Trust Portal 10 min
3. 3. CC3 Risk Assessment: asset inventory, threat identification, likelihood, impact, residual risk 11 min
4. 4. CC4 Monitoring Activities: continuous monitoring, deficiency reporting, remediation tracking 10 min
5. 5. CC5 Control Activities: selection, technology-general controls, segregation of duties 10 min

Common Criteria CC6 through CC9 are the technical operating layer where most audit findings sit. This module walks Logical and Physical Access controls (identity, MFA, provisioning, physical security), System Operations (detection, incident response, backup and recovery), Change Management (development lifecycle, testing, approval, deployment), and Risk Mitigation (vendor and third-party risk, business continuity). Closes with the 2022 Revised Points of Focus that specify what auditors now expect beyond the 2017 criteria.

1. 1. CC6 Logical and Physical Access Controls: IAM, MFA, provisioning, remote access, keys 12 min
2. 2. CC7 System Operations: detection tooling, incident response, backup and recovery 11 min
3. 3. CC8 Change Management: dev lifecycle, code review, testing, approval, deployment, rollback 11 min
4. 4. CC9 Risk Mitigation: vendor risk, third-party risk, business continuity, insurance 10 min
5. 5. The 2022 Revised Points of Focus: what auditors now specifically look for 10 min

Beyond Security (Common Criteria mandatory), the four optional Trust Services Criteria are Availability, Processing Integrity, Confidentiality, and Privacy. This module walks each: what it means, what customers most often demand, what controls it requires, and how it interacts with the Common Criteria. Closes with a decision matrix on which TSCs to add based on your industry, customer contract requirements, and business risk profile.

1. 1. Availability TSC — the uptime criterion 10 min
2. 2. Processing Integrity TSC — the transaction criterion 10 min
3. 3. Confidentiality TSC — the trade-secret criterion 9 min
4. 4. Privacy TSC — and the GDPR / DPDP Act 2023 / CCPA overlap 11 min
5. 5. TSC decision matrix — which to add and when, by industry 10 min

SOC 2 fails on artefacts, not on intentions. This module builds the operating layer: a Control Matrix mapping every applicable TSC criterion to a control, owner and evidence source; the 10-policy pack the auditor will ask to see on day one; a Risk Assessment Framework that starts with asset inventory and produces a residual risk register; a Vendor Risk Register with onboarding and ongoing monitoring; an Incident Response Plan with a tabletop exercise runbook. Every template is embedded inline and can be lifted into a live audit period.

1. 1. The Control Matrix — mapping TSC clauses to controls, owners and evidence 18 min
2. 2. The 10-Policy Pack — draft skeletons your auditor will ask to see 22 min
3. 3. Risk Assessment Framework — asset, threat, likelihood, impact, residual risk 16 min
4. 4. Vendor Risk Register — the working register your auditor tests against CC9.2 14 min
5. 5. Incident Response Plan and Tabletop Runbook 17 min

SOC 2 fails on evidence, not on framework understanding. This module builds the evidence operating layer: continuous versus point-in-time evidence, the Buy versus Build decision (Vanta, Drata, Sprinto, Secureframe, Comply.ai versus in-house), evidence types the auditor accepts, a monthly evidence collection calendar with owner sign-offs, and audit trail hygiene that keeps the evidence pack organised across a 12-month examination period.

1. 1. Continuous vs point-in-time evidence, and how the auditor samples 9 min
2. 2. Buy vs Build: Vanta, Drata, Sprinto, Secureframe, Comply.ai, or in-house 12 min
3. 3. Evidence types: what makes evidence auditor-quality vs unusable 10 min
4. 4. The Evidence Collection Calendar, a twelve-month template 11 min
5. 5. Audit trail hygiene: organising the evidence pack for the first 48 hours of fieldwork 9 min

The audit quarter. This module walks the SOC 2 examination from the RFP process (Big 4 versus mid-tier versus SOC 2 boutique specialists) through engagement letter drafting under SSAE 18, kickoff and sample selection, interviews and walkthroughs, evidence review and testing, findings and remediation, and finally the auditor opinion (unqualified, qualified, adverse, disclaimer). Includes the Auditor RFP + Selection Matrix template and the SOC 2 Engagement Letter template.

1. 1. What makes a SOC 2 auditor: licensing, independence, sector experience 9 min
2. 2. The Auditor RFP and Selection Matrix: running Big 4 against mid-tier against boutique 11 min
3. 3. The SOC 2 Engagement Letter, full SSAE 18 template 14 min
4. 4. The audit cycle week by week, kickoff to report issuance 10 min
5. 5. Auditor opinion types: unqualified, qualified, adverse, disclaimer 8 min

Life after the first SOC 2 report. This module walks publishing the report on the customer trust portal, using it to answer vendor security questionnaires (VSAQ, CAIQ, SIG), the annual re-audit cycle with bridge letters between audit periods, adding TSCs beyond Security (Availability then Confidentiality most commonly), the SOC 2 to ISO 27001 upgrade path, and the emerging AI controls per COSO Generative AI Internal Control Guidance February 2026.

1. 1. Publishing the SOC 2 report on your customer trust portal 14 min
2. 2. Answering vendor security questionnaires (VSAQ, CAIQ, SIG) with the SOC 2 report 11 min
3. 3. The annual re-audit cycle and the bridge letter 13 min
4. 4. Adding TSCs beyond Security: Availability, then Confidentiality, then Privacy 10 min
5. 5. SOC 2 to ISO 27001 upgrade path and emerging AI controls 11 min