From failed readiness review to clean SOC 2 audit

Challenge

An enterprise customer made SOC 2 Type II a condition of renewal. The readiness review the company commissioned found 41 critical findings: no central logging, shared admin accounts, laptops without disk encryption, a backup that had never been restored, and policies that existed as a folder of templates nobody had read. The renewal was nine months away. The engineering team was 22 people and none of them owned security.

Approach

We started with the posture assessment, re-scored against NIST CSF 2.0 so the findings had a priority order rather than a list. The first month closed the fastest, highest-value gaps: MFA on every account through Okta, endpoint detection on every laptop and server, disk encryption enforced by policy, and a daily immutable backup with a restore tested in week three.

Month two to four built the controls that produce their own evidence. Logs from AWS, Okta, the endpoints and the application flowed into Microsoft Sentinel with 40 tuned detections. Access reviews ran quarterly from a script, not a spreadsheet. Infrastructure changes went through Terraform with a required reviewer, which gave the auditor a change-management trail without a ticketing project. Vanta tracked every control and flagged drift.

Month five was a tabletop exercise with the leadership team, a penetration test of the payment API, and remediation of the six findings it produced. Month six was the audit observation window, with our engineer on the calls.

Result

The Type II audit passed with zero exceptions. The customer renewed for three years. The 41 critical findings were closed with evidence attached to each one, and the security practice now runs the estate under a Professional managed tier with quarterly evidence packs, so the second audit is a formality rather than a project.