Skip to content

SOC 2 Type 1 Readiness (GetAgency checklist)

Purpose. Tracks Soon's readiness against the 68-control SOC 2 Type 1 checklist received from GetAgency on 2026-08-07 (Security / Common Criteria CC1–CC9). The checklist itself is the external file; this document records the position, the gaps, and who owns them. It is also the SOC 2 ↔ ISO 27001 bridge the Evidence Register flagged as missing.

Status: DRAFT — first pass, filled from the ISMS on 2026-08-07. Type 1 tests that controls exist at a point in time, so a control only counts as Done when it exists and evidence can be captured today. Most Soon policies are status: draft (not yet owner-approved), which is why they read In progress.

Position (first pass)

Status Count Meaning
✅ Done 18 Control exists and evidence is capturable now
🟡 In progress 45 Policy/process exists but is draft, or partially implemented
⬜ Not started 3 Nothing in place yet (both tabletop tests; see below)
➖ N/A 2 Board charter / board expertise — founder-run company, no separate board

Not the same as ISO progress. Many "In progress" items become "Done" simply by approving the existing draft policy and capturing one screenshot — the substance is largely written.

The gaps that actually block Type 1

Ranked by how hard an auditor will push:

  1. Backup restore test has never been run (#60, CC7.5) — the single most-cited gap. PITR is off; retention 7d/30d. Owner: Melvin. See Backup Policy.
  2. Penetration test not yet performed (#52, CC7.1) — included in the GetAgency engagement but not delivered. Owner: Olaf.
  3. No incident-response or DR tabletop test (#59, #66) — one 1-hour session, minuted, can evidence both (and pair with the restore test). Owner: Olaf/Melvin.
  4. No BC/DR plan (#65, CC9.1) — the targets are now set (99.5% uptime, RTO 8h, RPO 24h, confirmed 2026-08-13); the plan document itself still needs writing.
  5. No MDM/EDR on BYOD endpoints (#50, CC6.8) — weakest technical area; adopt MDM or document a compensating control. Owner: Olaf.
  6. No System Description (#20, CC2.3) — a required Type 1 deliverable; inputs exist in Context & Scope and the asset inventory.
  7. Policies still draft — approving the set converts many rows to Done at once.
  8. Vendor register / DPAs not collected (#67, #68) and retention periods unset (#42).

How this maps to the rest of the ISMS

  • Evidence for each control is collected per the Evidence Collection & Management Procedure and indexed in the Evidence Register. GetAgency asks for a SOC 2 Evidence folder with a subfolder per CC series — that maps onto the S3 evidence store keyed by control (ISMS-DOC-07-7 §4.5).
  • Automated checks for many of these controls already exist in the Automated Control Check Catalog and run from the soon-grc repo — e.g. MFA (CHK-MFA-01), encryption (CHK-ENC-01/02), CloudTrail (CHK-LOG-01), backups (CHK-BACKUP-01), branch protection (CHK-SDLC-01).
  • ISO 27001 overlap is high: the same controls and evidence serve both certifications, which is the strategy in ROADMAP.md.

Open questions for the owner

Recorded in the checklist itself (highlighted rows) and summarised in OPEN-QUESTIONS.md. Key ones: password manager adoption, MDM/EDR, AWS GuardDuty for IDS, background checks for future hires, anonymous whistleblowing channel, fraud-risk scenarios, MSA location, and customer-notification channel.

Change log

Version Date Author Comments
0.1 2026-08-07 ISMS First pass — GetAgency's 68-control Type 1 checklist filled from the ISMS (18 Done / 45 In progress / 3 Not started / 2 N/A); gaps ranked and owners assigned.