SOC 2 Essentials Compliance
A curated subset of the 30 most critical SOC 2 controls spanning Security and Availability criteria, extending Starter with broader coverage of monitoring, vendor management, and system operations.
Overview
SOC 2 Essentials selects 30 critical controls spanning Security, Availability, and Confidentiality Trust Service Criteria.
It extends Starter with vendor management, availability commitments, continuous monitoring, and data handling controls.
The framework prepares organisations for SOC 2 Type I examination readiness.
Implementation takes three to six months after Starter completion, tracked in the MyCISO platform.
Essentials is step two: Starter (15) > Essentials (30) > Full SOC 2 examination readiness.
Key Areas
- All 15 controls from SOC 2 Starter, plus:
- CC1.2 - Board oversight of internal control
- CC1.4 - Commitment to competence (hiring and training)
- CC2.2 - External communication of security commitments
- CC3.3 - Assessment of changes that could impact internal control
- CC4.1 - Monitoring and evaluation of internal controls
- CC5.2 - Deployment of control activities through policies and procedures
- CC6.7 - Restriction and management of data transmission
- CC6.8 - Prevention and detection of unauthorised software
- CC7.5 - Recovery from identified security incidents
- CC9.1 - Identification and management of vendor and business partner risk
- CC9.2 - Vendor risk assessment and monitoring
- A1.1 - System availability commitments and performance standards
- A1.2 - Environmental protections and redundancy
- A1.3 - Recovery and continuity planning and testing
- C1.1 - Confidential information identification and protection
Who It's For
- SaaS companies actively preparing for their first SOC 2 examination
- Service providers that need to include Availability in their SOC 2 scope
- Organisations that completed SOC 2 Starter and want to expand readiness
- Companies that want to start conversations with CPA firms from a position of strength
- Teams building a phased SOC 2 preparation program with clear milestones
Core Requirements
- Policies and Governance
- Extend governance to include board or executive oversight of internal controls (CC1.2), competence requirements for security roles (CC1.4), and external communication of security commitments to customers (CC2.2). Deploy control activities through documented policies and procedures (CC5.2).
- Risk Management
- Add assessment of changes that could impact the control environment (CC3.3), monitoring and evaluation of internal controls (CC4.1), and formal vendor risk management (CC9.1, CC9.2).
- Security Controls
- Implement data transmission controls (CC6.7), software management and whitelisting (CC6.8), confidential information handling (C1.1), and system availability measures including environmental protections and redundancy (A1.1, A1.2).
- Incident Response
- Extend incident management to include recovery procedures (CC7.5) and recovery/continuity planning with regular testing (A1.3).
- Evidence and Reporting
- Evidence requirements expand to include board meeting minutes discussing security, vendor assessment records, availability metrics, recovery test results, and confidentiality controls documentation. Continuous monitoring evidence (CC4.1) demonstrates ongoing control effectiveness.
Implementation Steps
- Assess expanded scope - Assess maturity against the 15 additional Essentials controls. Starter scores carry forward. Focus on identifying gaps in vendor management, availability, and monitoring maturity.
- Vendor management - Establish a vendor risk management program. Identify critical vendors, conduct security assessments, and define ongoing monitoring procedures (CC9.1, CC9.2).
- Availability and continuity - Define availability commitments (A1.1), implement environmental protections and redundancy (A1.2), and develop and test recovery plans (A1.3).
- Control monitoring - Implement ongoing monitoring and evaluation of internal controls (CC4.1). Assess how changes to the business or technology environment could impact controls (CC3.3).
- Data handling - Implement data transmission controls (CC6.7), software management (CC6.8), and confidential information handling procedures (C1.1).
- Prepare for examination - Review all 30 controls and their evidence. Begin conversations with CPA firms about SOC 2 Type I readiness. Ensure evidence collection processes are producing the artifacts auditors will need.
Frequently Asked Questions
- Do I need to complete Starter before Essentials?
- Recommended but not required. Essentials includes all 15 Starter controls plus 15 additional controls. Start with Essentials directly if your organisation already has basic SOC 2 controls in place.
- Am I ready for a SOC 2 audit after Essentials?
- Essentials prepares you for a strong SOC 2 Type I examination. For Type II, you will also need at least six months of evidence demonstrating that controls operate effectively over time. Start collecting evidence early.
- Why does Essentials add Availability?
- Most SaaS customers requesting SOC 2 reports expect both Security and Availability criteria to be in scope. Including Availability from the Essentials stage avoids having to retrofit these controls later.
- How does this compare to ISO 27001 Essentials?
- Both cover 30 controls and address similar security domains. SOC 2 Essentials is structured around AICPA Trust Service Criteria and is more relevant for US-market SaaS companies. ISO 27001 Essentials follows the Annex A structure and carries international recognition.
Why It Matters
- SOC 2 Essentials addresses the controls that auditors report as the most common areas of weakness: vendor management, availability monitoring, data handling, and incident management maturity. Covering these proactively reduces examination risk.
- Adding Availability criteria to the scope reflects reality: most SaaS customers care about uptime as much as security. Including Availability in your SOC 2 preparation demonstrates customer-focused thinking.
- The 30 controls in Essentials cover the areas most commonly referenced in enterprise procurement security questionnaires. Completing Essentials substantially strengthens your ability to respond to customer due diligence.
Common Challenges
- Vendor management programs that are overly bureaucratic and create friction with business relationships
- Availability commitments that are unrealistic or not backed by technical architecture
- Recovery and continuity plans that are documented but never tested
- Continuous monitoring generating alert fatigue rather than actionable intelligence
- Confidentiality controls that impede legitimate business operations
- Difficulty demonstrating board oversight when security discussions are informal or undocumented