Lion Cipher Lab
Prepare evidence for a SOC 2 audit
- GRC / Compliance
- Beginner
- ~55 min
- Free · no account required
Why it matters
If your small business wants to sell software or a service to bigger companies, sooner or later one of them will ask: 'Can we see your SOC 2 report?' A SOC 2 is an independent examination -- done by an outside accountant called an auditor -- of whether the promises you make about protecting customer data are actually true and actually working. It has become the default trust badge in the business-to-business software world: no report, no deal. Here is the part nobody explains to beginners, and the part this lab exists to fix: an audit is not won by having good security in your head or good…
What you'll learn
- what SOC 2 is, who it is for, and what it is not
- what a control is (a rule or safeguard you put in place)
- what an audit is, and what an auditor actually does
- what evidence is, and why audits are won or lost on it
- the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy)
- the Security / Common Criteria as the required baseline
- the difference between a SOC 2 Type I and a Type II report
- what an audit period is and why evidence must fall inside it
- mapping a control to the specific evidence that proves it
- the common evidence types (screenshot, export, policy, log, ticket)
Steps in this lab
- What SOC 2 is -- and the one word the whole thing runs on
- The Trust Services Criteria -- the five things a SOC 2 can judge
- Type I vs Type II -- a photo versus a movie
- What a control is, and what counts as evidence
- Pick your scope, then build the evidence tracker
- Map each control to its evidence -- five worked rows
- Assemble the evidence package -- an organized folder an auditor can navigate
- Make the evidence audit-quality -- dated, redacted, complete
- What you built, and the mindset to keep