Markdown Editor
Відкрити редактор

Набір підготовки до SOC 2

Підготовка до звіту SOC 2 Type 1 або Type 2: опис системи, розриви з критеріями, ключові контролі, операційні докази та внутрішній аудит.

Шаблонів: 12, кроків: 4, у порядку використання. Відкрийте будь-який шаблон у редакторі, заповніть його та експортуйте в PDF, DOCX або HTML.

Крок 1

Постановка задачі

  1. SOC 2 Readiness Assessment Template (TSC 2017, DC 200)

    Повний

    SOC 2 drivers, scope and boundary, DC 200 description readiness, 0-3 rating of every criterion, gap register, roadmap, Type 1 or Type 2 plan, auditor selection

    AICPA TSC 2017 (revised points of focus 2022); DC 200 (2022 guidance)

  2. SOC 2 Control Mapping Template

    Повний

    All 61 SOC 2 criteria (CC1-CC9, A, C, PI, P), Type 1 vs Type 2, DC 200 system description, CUEC/CSOC, gap register, evidence and sampling

    AICPA 2017 TSC (rev. points of focus 2022); DC 200 (2018, rev. 2022)
Крок 2

Контролі

  1. Information Security Policy Template

    Стандарт

    ISMS policy – CIA commitments, sub-policies

    ISO/IEC 27001:2022 + Amd 1:2024, clause 5.2 and Annex A 5.1

  2. Risk Register Template

    Стандарт

    Risk register with appetite, inherent and residual scores, Annex A controls, owner acceptance with expiry, inherent and residual heat maps, review log

    ISO/IEC 27001:2022 + Amd 1:2024 cl. 8.2, 8.3; ISO 31000:2018

  3. Supplier Security Assessment Template

    Стандарт

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I

  4. User Access Review Template (ISO 27001, SOC 2, SOX)

    Повний

    Audit-grade user access review: population completeness, per-account decisions, privileged and service accounts, SoD, leavers, remediation, ISO/SOC 2/SOX mapping

    ISO/IEC 27001:2022 A.5.18, A.8.2; AICPA TSC 2017 CC6.2, CC6.3; SOX 404 ITGC

  5. Change Request Template (ISO/IEC 20000-1, ITIL)

    Повний

    ITSM change record: change type, risk scoring, linked CIs, schedule and freeze check, authority, tests, backout window, PIR and closure code

    ISO/IEC 20000-1:2018 8.5.1; ISO/IEC 27001:2022 A.8.32; ITIL practice names
Крок 3

Експлуатація

  1. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Повний

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  2. Backup and Restore Procedure Template (3-2-1-1-0)

    Повний

    Data inventory, backup sets, 3-2-1-1-0 check, immutability lock settings, jobs, monitoring, restore steps, compromise recovery, restore evidence, roles

    3-2-1-1-0 convention; NIST SP 800-34 Rev. 1; NIST SP 800-53 Rel. 5.2.0 CP-9, CP-10

  3. IT Disaster Recovery Plan Template (NIST SP 800-34)

    Повний

    DR plan per NIST SP 800-34: BIA summary, tiers, strategies, activation, recovery, reconstitution, SP 800-84 test and exercise types, DR test report links

    NIST SP 800-34 Rev. 1; NIST SP 800-84; ISO/IEC 27031:2025
Крок 4

Докази та аудит

  1. Internal Audit Program and Report Template

    Стандарт

    Audit schedule + report with findings

    ISO 19011:2026; clause 9.2 of ISO 9001:2026, ISO/IEC 27001:2022, ISO 14001:2026, ISO/IEC 42001:2023

  2. Control Testing Workpaper Template (SOX ICFR, Design and Operating)

    Повний

    Test one ICFR control: attributes, walkthrough, population, IPE, sample size, attributes, results, exceptions, root cause, conclusion, retest, sign-off

    SOX 404(a); Exchange Act Rule 13a-15(c); SEC Release 33-8810; GAO Green Book 2025