Kit de preparación SOC 2

SOC 2 drivers, scope and boundary, DC 200 description readiness, 0-3 rating of every criterion, gap register, roadmap, Type 1 or Type 2 plan, auditor selection

All 61 SOC 2 criteria (CC1-CC9, A, C, PI, P), Type 1 vs Type 2, DC 200 system description, CUEC/CSOC, gap register, evidence and sampling

ISMS policy – CIA commitments, sub-policies

Risk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log

Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

Audit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping

ITSM change record: change type, risk scoring, linked CIs, schedule and freeze check, authority, tests, backout window, PIR and closure code

IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

Data inventory, backup sets, 3-2-1-1-0 check, immutability lock settings, jobs, monitoring, restore steps, compromise recovery, restore evidence, roles

DR plan per NIST SP 800-34: BIA summary, tiers, strategies, activation, recovery, reconstitution, SP 800-84 test and exercise types, DR test report links

Audit schedule + report with findings

Test one ICFR control: attributes, walkthrough, population, IPE, sample size, attributes, results, exceptions, root cause, conclusion, retest, sign-off