For growing companies / First SOC 2
Your first SOC 2, step by step
From a customer asking for your report to the report in hand. Every step is marked as Deixic’s work or yours.
The checklist
Nine steps, in order.
#StepWhoWhat happens
01A customer asks for your SOC 2 reportYouYou know which customer and which report.
02Pick your scope and your auditorYouAny auditor works. They bill you directly.
03Connect your systemsYouIdentity, code, cloud, HR, devices, and Slack, plus your compliance platform if you have one.
04Deixic evaluates the controlsDeixicEach SOC 2 control is checked. In the example run, 9 of 73 fail.
05Deixic fixes what your policy allowsDeixic7 of the 9 are fixed within written policy.
06You approve and decide the restYouA named approver approves each sensitive change with a reason. Policy questions come to you as decisions.
07Read-backs and receiptsDeixicEach change is read back, the test is re-run, and the receipt is signed and hash-linked.
08Observation window for Type IIYou and DeixicYou run the company. Deixic keeps checking the controls and fixes or routes any that fail.
09Auditor fieldwork from exportsYou and DeixicYour auditor works from the receipts, exported as PDF, HTML, or JSON. Report in hand.