SOC 2 Readiness Assessment for a SaaS Platform

Why SOC 2 became a requirement for new contracts

The reason was simple: several prospective US clients would only sign contracts if the company met SOC 2 requirements. Without preparing for an independent audit, the company risked losing those deals. Nor was this a case of crisis management; the company had been free of security incidents to date.

What worried the SaaS team was not some past breach, but that its current security protocols were not part of a managed and documented system of controls. The focus was on pre-empting threats such as unauthorized access to customer data, the leaking of corporate information, and accounts being compromised, and putting an end to them before they could materialise.

These gaps affected several areas:

1. Not all rules were documented. Some security practices were already in place but had not been formalized in policies and procedures. For a SOC 2 auditor, a verbal agreement does not constitute evidence of a control.

2. Access management was not sufficiently formalized. Regular reviews of user permissions, including privileged accounts, had not been established as a separate process.

3. Security event logging and monitoring were limited, and there was no formalized incident response procedure.

More broadly, information security risk management lacked structure: the company did not conduct regular risk assessments.

If these gaps remained unaddressed, the consequences could extend far beyond the risk of failing an audit. Without an established incident response procedure, the company would have to handle any actual security incident without a clear action plan – with all the potential consequences for customer data, its reputation, and the contracts that had prompted the project in the first place.

How we assessed SOC 2 readiness

SOC 2 readiness involves reviewing controls, addressing gaps, and preparing evidence of their implementation for the auditor.

SOC 2 readiness assessment

The core of the project was assessing the company's readiness for SOC 2. The assessment covered four areas:

• security management;
• security policies and processes;
• access control;
• cloud infrastructure security.

Each area covered a portion of the SOC 2 criteria defined for the project, either organizational or technical. We analyzed internal documentation and assessed the following systems and processes against the SOC 2 Trust Services Criteria defined for the project:

• SaaS platform cloud infrastructure;
• identity and access management system (IAM, roles, privileged accounts);
• SaaS platform architecture and REST API integrations;
• security event logging and monitoring system;
• company information security policies;
• incident response procedures;
• risk management processes;
• IT infrastructure change management processes.

How our team organized the work:

1. Information gathering and analysis. We collected everything that already existed in documentation and daily practice and found that some security processes were actually in place, but different teams followed them differently, without a unified control system or centralized documentation.

2. Gap analysis against the defined SOC 2 criteria. We compared each existing control against the criteria, documented the gaps, and classified them by severity.

3. Working sessions with the client's team. Rather than simply providing a list of recommendations, we worked alongside the client's technical and management teams to turn fragmented practices into unified, documented processes.

4. Formalization of processes and controls. We formalized and improved:

• a complete set of information security policies aligned with the SOC 2 criteria defined for the project;
• a formalized access management process, including regular permission reviews and privileged account controls;
• a Change Management Process for controlled changes to IT infrastructure;
• an expanded security event logging and monitoring system;
• a regular information security risk assessment cycle instead of one-off reviews.

Incident response plan development

Datami developed an Incident Response Plan for the company. This document defines the procedures to follow in the event of an incident, from detection and assessment to remediation and recovery. To ensure coordinated action across the team, the plan establishes responsible roles, escalation procedures, and communication protocols.

SOC 2 readiness assessment results

During the project, the Datami team identified 16 gaps in security controls:

• 3 critical (including privileged access management and the lack of a formalized incident response process);
• 6 medium-severity (event logging and access control);
• 7 low-severity (policy documentation and change management processes).

Three gaps were classified as critical at the control level and required priority remediation before the audit. The client closed the main gaps as part of the agreed audit preparation plan.

The same scenarios that had concerned the SaaS team at the start (unauthorized access due to insufficient privileged account controls, delayed detection of suspicious activity due to limited logging, and uncoordinated incident response due to the lack of a formalized plan) became less likely after the controls were implemented.

From both a technical and process perspective, the result came down to one thing: fragmented security practices were transformed into a managed system of controls, with formal policies, regular access reviews, an incident response plan, and expanded security event monitoring.

As a result of this project, the SaaS company achieved the following business outcomes:

• achieved readiness for a SOC 2 Type I audit;
• opened the door to securing contracts with large enterprise clients in the US;
• reduced the risk of reputational and legal consequences resulting from leaks of clients' corporate data.

What's next: recommendations following the SOC 2 compliance assessment

Based on the assessment results, the client received recommendations for the next steps:

• regular internal audits of SOC 2 controls;
• automation of event monitoring and log management;
• periodic penetration testing and security assessments;
• an employee cybersecurity training program;
• preparation for SOC 2 Type I and SOC 2 Type II audits (Type II requires demonstrating the effectiveness of controls over a period of time, rather than at a single point in time).

From readiness assessment to a clear action plan

For the SaaS company, entering the US enterprise market required being ready to demonstrate SOC 2 compliance through an independent audit.

Over 10 weeks, Datami assessed the existing controls. We identified 16 gaps and developed security documentation, including an incident response plan. The SaaS company received recommendations for addressing the identified issues, and after the client implemented the controls, its readiness for a SOC 2 Type I audit was confirmed.

This case study shows how an independent assessment and the development of policies and procedures help transform individual security practices into a managed and documented system of controls.

Preparing for a compliance audit and don't know where to start?

Contact Datami – we'll conduct a security audit of your digital assets and assess your company's readiness for compliance audits. We'll help you identify which gaps need to be addressed first.