SOC 2 Training for Teams and Control Owners

Our SOC 2 training helps technology and service organisations understand the AICPA Trust Services Criteria, design controls that auditors can test, and prepare for a SOC 2 Type 1 or Type 2 examination. SSC runs SOC 2 courses for leadership, engineering, security and compliance teams, live online or on-site, so everyone knows what the auditor will ask for and why.

SOC 2 courses at a glance

What SOC 2 is, and what it is not

SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines a service organisation’s controls against the Trust Services Criteria and issues a report with an opinion. It is not a certification and there is no certificate: customers read the report, including the description of your system and any exceptions.

• Five categories: Security, which is always in scope, plus Availability, Processing Integrity, Confidentiality and Privacy, which you include when your customers rely on them.
• Type 1: assesses whether controls are suitably designed at a point in time.
• Type 2: assesses whether controls operated effectively over a period, typically three to twelve months.

Course details

SOC 2 Fundamentals

Typical duration: 1 day. Who it is for: everyone who will own or support a SOC 2 control.

• How customers use SOC 2 reports in vendor due diligence
• The Trust Services Criteria and common criteria series
• Type 1 versus Type 2, report sections and what exceptions mean
• Roles of management, control owners and the service auditor

You will be able to: explain SOC 2 to colleagues and customers and understand your own part in it.

SOC 2 Readiness and Controls Practitioner

Typical duration: 2 days. Who it is for: security, compliance and engineering leads.

• Scoping the system description: services, infrastructure, software, people, data and boundaries
• Designing controls for access, change management, monitoring, incident response, vendors and risk
• Complementary user entity controls and subservice organisations such as cloud providers
• Building a control matrix and a readiness assessment
• Choosing an audit firm and planning the observation period

You will be able to: run a SOC 2 readiness assessment and a remediation plan that leads into a clean audit.

SOC 2 evidence and audit preparation workshop

Typical duration: 1 day. Who it is for: control owners in engineering, IT, HR and operations.

• What good evidence looks like for access reviews, onboarding and offboarding, change approvals and backups
• Sampling: how auditors select items and why every instance matters in a Type 2
• Automating evidence collection where possible
• Handling auditor requests and walkthroughs

You will be able to: produce complete, consistent evidence throughout the observation period.

Preparing for the auditor

We use a realistic SaaS case study with a cloud-hosted product, a small engineering team and several subservice providers. Participants write part of a system description, map risks to criteria, design controls, and respond to mock auditor requests. Private courses can use your own control matrix.

SOC 2 or ISO 27001?

Customers in North America often ask for SOC 2; customers in Europe, Australia, New Zealand and the Middle East often prefer ISO 27001. Many controls overlap, so one control set can support both. Our combined course shows how to map them and avoid duplicate work.

How the SOC 2 training is delivered

• Live online. Instructor-led virtual classes over Microsoft Teams or Zoom, with breakout exercises, shared workbooks and the option to split longer courses into half-day sessions across a week or two.
• On-site at your premises. Private training for your team at your office, delivered by a consultant who can use your own policies, systems and examples in the exercises.
• Private and tailored. Every course can be run for a single organisation, with case studies drawn from your sector and the depth adjusted to your team’s experience.

What participants receive

• A course workbook and the slides used in class
• Reusable templates and checklists, such as audit checklists, risk registers and report formats, depending on the course
• A case study pack and practice questions
• A certificate of completion from Security Solution Consultants

Certificates

Every participant receives a certificate of completion from Security Solution Consultants. SOC 2 itself is an attestation performed by licensed CPA firms, so there is no individual SOC 2 auditor certification from the AICPA; our courses prepare your team to work effectively with your chosen audit firm.

Why train with SSC

• Taught by practitioners. Our trainers are working consultants and auditors who prepare SaaS and technology companies for SOC 2 examinations, so examples come from real engagements rather than slides.
• We hold ourselves to the same standard. SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach. See our Trust Centre.
• Hands-on with real tools. Exercises can use GRCLens, the GRC platform built by SSC, so participants practise with risk registers, control libraries and evidence the way they will at work.
• Training that connects to delivery. If your team needs help after the course, the same people can support implementation, internal audits and certification readiness.

Related: security compliance services for SOC 2 readiness, and the GRCLens SOC 2 module. See all training courses.