SOC 2 readiness for Australian SaaS: timeline and evidence

An attestation, not a certification

A licensed CPA firm examines your controls against the AICPA’s Trust Services Criteria and issues a report with its opinion. Nobody “certifies” you, and TrustProof does not issue SOC 2 reports or decide audit outcomes. If you want the background on what SOC 2 is and how it relates to ISO/IEC 27001, start with our cornerstone SOC 2 guide; this one focuses on the work. TrustProof’s SOC 2 readiness page shows what the product covers.

Type I or Type II: how to decide

A Type I report describes whether your controls are suitably designed at a single date. A Type II report adds testing of whether they operated across an observation period. Ask your customer which one the contract or procurement process names. If a Type II is required, a Type I can be a stepping stone only if the customer will accept it while your observation period runs.

A realistic timeline

Every company differs, so treat these as general ranges to discuss with your CPA firm, not promises. Allow months rather than weeks for a first report.

• Readiness work: scoping, finding AWS gaps, writing and approving policies, and setting up how evidence is collected. This can take from a few weeks to a few months, depending on how many gaps you start with and how much time your team can spare.
• Observation period (Type II only): commonly in the range of three to twelve months, agreed with your CPA firm. Controls must operate and be evidenced throughout.
• Fieldwork and report: after the period ends, the firm requests evidence, tests samples and drafts the report. Allow several weeks and book the firm early, because availability affects timing.

The biggest swing factors are the number of AWS gaps, whether policies already exist, and how consistently the team follows its own procedures during the period. A gap found mid-period is easier to fix than an exception found in testing.

What auditors ask for

Your CPA firm gives you its own request list. These are typical examples of the evidence behind a Security-only scope, each with a date:

• Approved policies and procedures, with version history and evidence that staff have read them.
• A risk assessment and the register of actions that came from it.
• Joiner and leaver records showing access granted and removed on time, plus periodic access reviews.
• Change records: pull requests, approvals and deployment history for a sample of changes.
• Vulnerability scan results, a penetration test summary and how findings were closed.
• Incident records and a tested incident response plan.
• Supplier reviews for the vendors that touch customer data.
• Backup configuration and a restore test.
• Security awareness training completion for all staff.
• AWS configuration evidence, such as MFA status, logging and encryption settings, captured with its date.

For a Type II, the firm samples items from across the period, so evidence gathered as you go is easier to defend than a scramble at the end.

Scope decisions that change the workload

Security is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are optional categories that you agree with your CPA firm, and each one adds criteria to evidence. Choose them based on what you have promised customers in contracts and your website, not on what sounds thorough. You also decide which product, AWS accounts and environments sit inside the boundary. A narrower, clearly described boundary is easier to evidence than a broad one you cannot keep consistent.

Teams most often stumble on the same few things: policies that nobody follows, access reviews that are skipped, changes made outside the normal process and evidence that cannot be dated. Fixing these before the observation period starts is less work than explaining an exception afterwards.

AWS controls that matter most

On AWS, reviewers look at identity and access first, then data protection, network exposure and logging. TrustProof’s read-only SOC 2 checks map to four selected SOC 2 criteria (CC6.1, CC6.6, CC6.7 and CC7.2). They show AWS configuration only; most of SOC 2 depends on your procedures and records. Our guide to five AWS settings auditors check first covers the highest-priority ones, and what the AWS scan checks lists everything the scan looks at. If your customers are banks or insurers, also read CPS 234 for technology suppliers.

Getting started this week

1. 1

   Confirm what your customer needs

   Report type, categories beyond Security, and the date they need it.

2. 2

   Scan your AWS accounts

   Run the free read-only AWS scan and rank the findings by risk.

3. 3

   Talk to two or three CPA firms

   Ask about their experience with SaaS on AWS, their calendar, and how they handle independence if they also offer readiness help.

4. 4

   Assign an owner to each piece of evidence

   Decide who collects each item, where it is stored and how often.

5. 5

   Start the evidence trail

   Fix gaps through your change process, approve your policies and begin collecting dated records now, before any observation period starts.

FAQ

Frequently asked questions