Sample SOC 2 Readiness Report

Logical access controls not enforced across all production systems. 3 of 14 production VMs lack multi-factor authentication on privileged accounts. Attackers with a single credential compromise could pivot across services without a second factor. Recommendation: enforce MFA via your IdP across all systems, configure privileged access workstations, and enable just-in-time access provisioning for admin tasks.

Vulnerability scanning cadence is insufficient for production workloads. Last external scan was performed 7 months ago. Critical CVEs affecting your Ruby on Rails version were published 4 months prior with no remediation on record. Recommendation: implement monthly automated scanning with Defender or Qualys, maintain a remediation SLA of 30 days for critical findings, and track vulnerability burndown in your GRC tool.

Vendor risk management program is ad hoc. No formal inventory of critical vendors exists. Two vendors with access to customer PII (data warehouse provider, support ticketing SaaS) lack current SOC 2 reports or DPAs on file. The support vendor's last security questionnaire is from 2023. Recommendation: maintain a vendor inventory with data flow mapping, collect SOC 2 Type II reports for all vendors handling PII, and execute DPAs within 30 days of onboarding.

Disaster recovery plan exists but has not been tested. Recovery time objective (RTO) is documented as 4 hours, but no DR test has been executed in 18 months. The last failover test in Q2 2024 resulted in an 11-hour outage due to DNS misconfiguration. Without regular DR testing, your documented RTO cannot be relied upon for customer SLA commitments.