SOC 2 Starter Compliance

Overview

SOC 2 Starter selects the 15 most critical Common Criteria controls from the Security Trust Service Criteria.

It is a MyCISO derivative framework designed as a preparation tool for SOC 2 readiness.

The selection covers governance, access management, monitoring, incident response, and change management.

Implementation typically takes four to eight weeks with progress tracked in the MyCISO platform.

Starter is step one in a progression path: Starter (15 controls) > Essentials (30 controls) > Full SOC 2 readiness.

Key Areas

• CC1.1 - Control environment: commitment to integrity and ethical values
• CC1.3 - Management establishes structure, reporting lines, and responsibilities
• CC2.1 - Information and communication: internal communication of security objectives
• CC3.1 - Risk assessment: identification and assessment of risks
• CC3.2 - Risk assessment: identification of fraud risk
• CC5.1 - Control activities: selection and development of control activities
• CC6.1 - Logical and physical access: implementation of access controls
• CC6.2 - User registration and authorisation
• CC6.3 - Access removal for terminated employees
• CC6.6 - System boundaries and threat protection
• CC7.1 - Monitoring: detection of configuration changes and vulnerabilities
• CC7.2 - Monitoring of system components for anomalies
• CC7.3 - Evaluation of identified security events
• CC7.4 - Incident response procedures
• CC8.1 - Change management: authorisation, design, and testing of changes

Who It's For

• SaaS companies receiving their first customer requests for a SOC 2 report
• Service providers that need to demonstrate security practices to enterprise buyers
• Startups preparing for SOC 2 readiness as they move upmarket
• Companies that want to understand SOC 2 requirements before engaging an auditor
• Organisations building a phased SOC 2 preparation roadmap

Core Requirements

Policies and Governance

Demonstrate management's commitment to security through documented policies, defined organisational structure, and clear reporting lines (CC1.1, CC1.3). Communicate security objectives internally (CC2.1).

Risk Management

Conduct formal risk assessments that identify threats to the system (CC3.1), including fraud risk scenarios (CC3.2). Document risk evaluation criteria and treatment decisions.

Security Controls

Implement logical access controls (CC6.1) with formal user registration and authorisation (CC6.2), timely access removal for leavers (CC6.3), and boundary protection (CC6.6). Select and develop control activities to mitigate identified risks (CC5.1).

Incident Response

Establish monitoring for configuration changes, vulnerabilities (CC7.1), and system anomalies (CC7.2). Define procedures for evaluating security events (CC7.3) and responding to incidents (CC7.4).

Evidence and Reporting

Maintain evidence of access reviews, user provisioning and deprovisioning records, change management approvals, risk assessments, vulnerability scan results, and incident response activities. SOC 2 requires evidence over a review period, so establish collection processes early.

Implementation Steps

1. Scope definition - Define the system description: what services are in scope, what infrastructure supports them, and what data is processed. This is foundational for every SOC 2 examination.
2. Governance and risk - Document your control environment, organisational structure, and security policies. Conduct an initial risk assessment including fraud risk scenarios.
3. Access controls - Implement formal user provisioning, access reviews, and deprovisioning processes. These are the controls most frequently examined by auditors and most commonly found deficient.
4. Monitoring and detection - Deploy vulnerability scanning, configuration monitoring, and anomaly detection. Define procedures for evaluating and escalating detected events.
5. Change management - Establish a formal change management process with approval workflows, testing requirements, and rollback procedures (CC8.1).
6. Evidence collection - Begin systematic evidence collection for all controls. SOC 2 Type II requires evidence over a period (typically 6-12 months), so starting early is critical. Progress to SOC 2 Essentials when ready.

Frequently Asked Questions

Can I pass a SOC 2 audit with just Starter?

No. Starter covers 15 of the most critical Common Criteria controls for the Security Trust Service Criteria only. A full SOC 2 examination requires comprehensive coverage of all applicable criteria. Starter is a preparation tool, not a substitute.

Why focus only on Security?

Security (Common Criteria) is required for every SOC 2 examination. Availability, Processing Integrity, Confidentiality, and Privacy are optional criteria added based on your services and customer requirements. Building a strong Security foundation first is the most efficient approach.

How were the 15 controls selected?

MyCISO selected the controls that auditors examine most frequently, that appear most often in examination findings, and that provide the greatest risk reduction. They span governance, access management, monitoring, incident response, and change management.

What is the difference between SOC 2 Starter and ISO 27001 Starter?

SOC 2 Starter follows the AICPA Trust Service Criteria structure used in SOC 2 examinations. ISO 27001 Starter follows the Annex A control structure. Choose based on which standard your customers and market require.

Why It Matters

• Enterprise buyers increasingly require SOC 2 reports before signing contracts. The sales cycle pressure to achieve SOC 2 readiness can lead to rushed, superficial implementations. Starter provides a structured, prioritised approach that builds genuine control maturity.
• The 15 selected controls address the areas that auditors examine most closely during SOC 2 engagements. Organisations that have these controls in place with supporting evidence avoid the most common examination findings.
• SOC 2 preparation is expensive if approached without a plan. By focusing on the highest-priority controls first, organisations can demonstrate early progress to customers while building toward full readiness in a cost-effective manner.

Common Challenges

• Underestimating the documentation requirements - SOC 2 auditors need evidence, not just assertions
• Access management processes that exist informally but are not documented or consistently followed
• Change management procedures that are bypassed for urgent fixes, creating gaps in the evidence trail
• Delayed access removal for terminated employees, which is one of the most common SOC 2 findings
• Not starting evidence collection early enough, leaving insufficient coverage for the Type II review period