DataSecureThere is no universal set of policy titles that automatically makes an organization SOC 2 compliant. Document the practices relevant to your service, commitments and controls; assign owners; put the procedures into operation; and keep evidence for the examination.
Start with your system and controls
A policy states an organization’s expectations; procedures explain how work is performed. A control is an activity or measure designed to address a risk or support a criterion. Evidence helps an auditor understand whether that control was designed and, for a Type II examination, operated over the relevant period.
The AICPA Trust Services Criteria provide criteria for evaluation, while the description criteria address the description of the service organization’s system. Work with your advisor and examining CPA firm to agree the scope and relevant controls.
Common policy areas to assess
Organizations may combine or separate documents. The right content depends on the actual service and its risks.
| Area | Questions the documentation might answer | Examples of supporting records |
|---|---|---|
| Access management | Who approves, changes, reviews and removes access? | Access requests, user inventories, review decisions and removal tickets. |
| Change management | How are changes requested, tested, approved and deployed? | Change records, approvals, test results and deployment history. |
| Incident response | How are events reported, escalated, investigated and closed? | Exercise results, incident tickets and follow-up actions. |
| Risk and vendor management | How are risks and relevant suppliers assessed and tracked? | Risk register, treatment decisions and vendor reviews. |
| Recovery and continuity | Who owns backups and recovery, and how are tests handled? | Backup settings, restoration tests and remediation records. |
| People and awareness | How are responsibilities communicated and training tracked? | Training assignments, completion records and acknowledgments. |
A policy starter outline
Copy this outline into your own document and complete it with the people who perform the work. It is a starting point, not a complete policy or a substitute for professional review.
- Purpose and scope: What risk or objective does the policy address, and which teams, systems and data does it cover?
- Owner and approver: Who maintains it, who approves changes and who performs the associated activities?
- Requirements: What must happen, under which circumstances, and how are exceptions authorized?
- Procedures and cadence: Link to the actual workflows and specify frequencies appropriate to your organization.
- Records and retention: Identify the evidence source, responsible owner and secure storage location.
- Review and history: Record approval, effective date, version, review dates and material changes.
Example: from access policy to evidence
A fictional SaaS company’s access policy says the system owner periodically reviews access to production. Its procedure identifies the systems, explains how the user population is obtained and asks reviewers to record decisions and track removals. For each review, the team retains the dated population, reviewer decisions, exceptions and follow-up tickets.
A policy alone does not prove reviews occurred, and a current user export alone does not show historical review decisions. Use the evidence matrix and worksheet to plan the source, owner, review and limitations for each activity.
Keep policies useful after approval
- Make documents accessible to the people expected to follow them and communicate material changes.
- Check that procedures match how the team actually works; avoid copying a template’s unrealistic commitments.
- Review documents on the organization’s defined schedule and when systems or responsibilities change.
- Record approved exceptions and follow-up rather than quietly omitting them.
- Preserve versions and approvals relevant to the examination period, subject to your retention rules.
Common questions
Does a template make us SOC 2 compliant?
No. A template can help organize a document, but management must adapt, approve and operate practices appropriate to the organization. The independent CPA firm performs its own examination.
How many policies are required?
There is no universal number or mandatory document structure for every engagement. Discuss your system, criteria and control design with your advisor and auditor.
What if our process changes during the period?
Document the change, approvals, effective date and any impact on evidence. Tell your auditor so the change can be considered in the examination.
Educational guidance, not an audit opinion or legal advice. Adapt documentation to your organization and confirm expectations with qualified advisors.
Turn documentation into a working program.
Discuss your scope, policy ownership and readiness with DataSecure365.
Book a demo ↗