The SOC2 Starting Seven
Honestly, this misses a huge point and does more harm than good. Having some of these things in place is fine of course, but it don&#x27;t really help you much, nor is most of it required.<p>SOC2 does not require: SSO, MDM, or almost anything specifically (And what&#x27;s with the JAMF pro recommendation? MDM is more than iPhones). What it does require are controls. It does not specify what those controls are. You need to create them yourself, and they need to be sufficient to meet the requirements of the Trust Services Criteria. And to have controls, you need to know what you are controlling and why.<p>This brings me to my point: To succeed in SOC2 you actually have to have a plan. You have to have written, reviewed, implemented, and audited policies. THAT is the single biggest hurdle for most companies.<p>You also need to know how to do a risk assessment on your organization. This is not terribly hard, but it is essential to SOC2.<p>And finally, you need buy-in from the governing bodies of your organization.<p>None of these things I mentioned are products. You can&#x27;t buy them. They take work. A hell of a lot of work. I will guarantee that most companies doing this for the first time do not have half of the processes in place that SOC2 requires. I doubt that 20% have internal audit procedures, for example, or sufficient end-user training.<p>And one more thing that will take nearly anyone who had done security by surprise if they don&#x27;t know it&#x27;s there. The COSO Principles. These were added to SOC2 in the wake of the Lehman Bros&#x2F;Enron scandal. They extend SOC2 to the entire governance structure of your organization, and include controls on financial reporting, hiring practices, employee review processes, etc. This is a major PITA, because it lies far outside the bailiwick of most CISOs or equivalent, and, again, it requires extensive cooperation from the rest of senior management.<p>As you can probably tell, I&#x27;ve done this before.