SOC 2 guide
SOC 2 gap analysis: what Sterling examines against the Trust Services Criteria, what you receive, and what happens next
Before any control is rebuilt, Sterling's gap analysis tests what you already run against the Trust Services Criteria. This guide covers what is examined and how, who should take part, the four deliverables, and how they decide the report type and examination period.
Key points
- Sterling's gap analysis, run with scoping as the first stage of a SOC 2 engagement, tests your controls and records against the Trust Services Criteria in scope.
- You receive a gap report by criterion, a draft control matrix, a remediation plan and a recommendation on the report type and examination period.
- SOC 2 has no Stage 1. The free readiness check, the gap analysis and a service auditor's readiness assessment are three different things.
- It raises no exceptions and gives no opinion: those belong to the service auditor, a licensed CPA firm independent of Sterling, which also issues the report.
The question a SOC 2 gap analysis answers, and the services it is mistaken for
A SOC 2 gap analysis shows, on evidence, which of your controls can stay, which are missing and which work but leave no record a service auditor could test.
The readiness check is Sterling's free online self-assessment: about ten minutes of your own answers, returned as a score with first priorities. The gap analysis, the first stage of a Sterling engagement and run with scoping, works from evidence rather than answers. SOC 2 has no Stage 1 at all: an examination is one engagement by the service auditor, not a two-stage audit.
Some CPA firms sell their own readiness assessment, a separate, optional service outside the report. Under the AICPA's independence rules, a firm must not assume management's responsibilities for a client whose controls it will examine, such as designing or running those controls or choosing which recommendations to adopt; ISAE 3000 practitioners face comparable rules. Such a firm may point out gaps, but the fixes and decisions remain yours. Sterling's own readiness assessment comes later, before the period.
| What is compared | Readiness check | Gap analysis | A service auditor's readiness assessment |
|---|---|---|---|
| Carried out by | You, online, free | Sterling's consultants with your team | A CPA firm, where offered, separately |
| When | Before any commitment | First engagement stage | Before the examination, if commissioned |
| Based on | Your own answers | Interviews, live settings, sampled records | The firm's review against the criteria |
| Designs the fixes | No | Yes, as owned, dated actions | Not if it will examine you |
| Part of the SOC 2 report | No | No | No |
What Sterling examines: the system, the criteria, the control matrix and the evidence
Each control is tested on four points: does it exist, is it written down, does it leave a record, do its operators know it. A control that works silently is still a gap, since inquiry alone will not satisfy a service auditor.
The system and its boundary
The work starts from the service customers rely on and the infrastructure, software, people, procedures and data behind it: which products, environments, cloud accounts, locations and teams sit inside, and which vendors are subservice organisations. The scope guide covers drawing that line.
The categories and the criteria
Security, tested through the common criteria CC1 to CC9, is in every report; the other four categories bring extra criteria only when included. The 2022 points of focus are a completeness test, not a checklist. Because the opinion is framed around your service commitments and system requirements, consultants trace each promise in your contracts and questionnaires to the control that keeps it.
The control matrix
An existing matrix, from a compliance platform or questionnaire answers, is checked for who performs each control, how often, over which population and with what record. Entries saying "regularly" are rewritten; with no matrix, one is drafted.
The evidence sources
Identity provider, cloud consoles, repositories and pipeline, ticketing, HR system, endpoint management, logging, vulnerability scans, backups, the vendor register and vendors' SOC reports, policy acknowledgements and management minutes; for BPO operations, badge and visitor records too.
The method: control-owner workshops, live walkthroughs and samples
Workshops with control owners
Consultants meet whoever performs each control, such as the engineer approving pull requests or the administrator removing leavers, not just the name in the policy.
Walkthroughs of live settings
An engineer shares a screen and opens branch protection, multi-factor enforcement, encryption, log retention and alert routing, while the consultant records the configuration against the policy. No credentials change hands and nothing is altered.
Samples and populations
A few recent leavers, deployments, access reviews and incidents are traced end to end, and each full list is checked for completeness, since the service auditor samples from whole populations, as the examination guide explains.
An illustration: branch protection enforces approval on the main application, but two infrastructure-as-code repositories accept direct pushes, and two of ten recent deployments lack an approved pull request. The gap report records a CC8 control that misses routes to production; the plan extends protection to every repository, adds a reviewed emergency route and gives the new setting time to run before the period.
What you receive: four deliverables
Your sponsor hears the findings first, at a closing meeting; the written set follows.
| Deliverable | What it contains | The decision it supports |
|---|---|---|
| Gap report by criterion | For each criterion in scope: the controls mapped, the evidence seen and each gap classed as missing, undocumented, not evidenced or inconsistent | How far you are from an examinable control set |
| Control matrix draft | Each control worded as it will be tested, with owner, frequency, tool, record, criteria and any reliance on customers or subservice organisations | What the examination will cover, and who answers for each control |
| Remediation plan | Each gap as an action with owner, sequence, date and effort in your people's time | What starts first, and whether your team can carry it |
| Examination-period recommendation | A Type 1 date or a Type 2 start and length, the annual and quarterly controls it must contain, and when to brief a service auditor | When the period opens, and when to appoint the CPA firm |
Three questions order the plan: is the control absent altogether, does the fix need weeks of operation before its records are worth sampling, and has a customer been promised it by a date? The timeline guide takes the calendar further.
Who needs to take part, and why each role matters
A control that nobody present can explain goes down as not evidenced, so invite these people:
- The executive sponsor, at the opening and closing meetings, because management's written assertion goes into the report.
- Whoever coordinates SOC 2, at every session.
- Engineering, DevOps and IT leads, with console access to cloud accounts, repositories, identity and monitoring.
- People operations, for screening, onboarding, training and leavers.
- A sales or customer success lead, who can say what contracts and questionnaires have already committed you to.
- Legal, privacy and vendor owners, for contracts, the privacy notice and vendors' SOC reports.
- Operations or support leads, for incidents and, where processing integrity is in scope, the checks on processing.
What the SOC 2 gap analysis is not
Not an examination. No service auditor takes part, nothing is forecast, and Sterling does not issue SOC 2 reports; opinions come from the CPA firm alone.
Not a readiness assessment. It maps what exists before the work starts; Sterling's readiness assessment later tests controls that have been operating.
Not a security test. No system is scanned or attacked; penetration tests are controls it looks for.
Not a dashboard or a policy pack. Platform tests confirm settings and templates supply wording; neither proves that manual reviews happen.
How long the gap analysis takes, and how it feeds Design™ or Drive™
For one product on one cloud platform with security alone, scoping and the gap analysis usually take two to four weeks; extra categories, products, locations or slow access to people add time.
Which route suits depends on the effort the plan calls for. Under Design™, the guided route, your team makes the changes with Sterling's templates, workshops and review. Under Drive™, the managed route, Sterling's consultants carry the agreed work, from policies and the system description to the evidence calendar, while management approves the description and signs its assertion. Whichever route you take, the control matrix moves into Effivity, included with the engagement, at no additional cost, as your control set. The implementation plan and service auditor guides cover what follows.
How Sterling approaches a SOC 2 gap analysis
Your systems as they run today, and a plan your control owners can carry.
Sterling's expert and experienced consultants sit with the people who operate your controls, keep what already meets the criteria and give every action an owner and a date. We hand over a control set ready to be examined and support you through fieldwork; the report and its opinion are the service auditor's alone.
Book a free discovery callSOC 2 gap analysis: questions buyers ask
Could the CPA firm that will examine us do the gap analysis instead?
It may offer a readiness assessment, but independence stops it from designing your controls or choosing your fixes. Separating preparation from examination keeps that question away from the customers who read your report.
We already use a compliance automation platform. What does a gap analysis add?
The platform shows whether settings pass its built-in tests, not whether the boundary is right, whether controls keep your contractual promises or whether people-dependent controls happen. The gap analysis uses its data and covers the rest.
Can we share the gap report with a customer who is waiting for our report?
Keep it internal: it details weaknesses and gives no assurance. A short management letter naming the categories, the report type and the planned examination period serves a waiting customer better.
Which documents should we collect before the gap analysis?
Existing material only: architecture diagrams, cloud accounts, the vendor register, current policies, customer contracts, recent questionnaires, penetration test reports, the incident log and an organisation chart. Draft nothing new first.
Does it cover our cloud provider and other vendors?
Yes. It identifies your subservice organisations, collects their SOC reports and reads the complementary user entity controls in them, which fall to you, then drafts the controls your description will expect each provider to run. The vendor management guide covers ongoing review.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 cost: what moves the price
- Effivity for SOC 2: the guide
- SOC 2 exceptions and qualified opinions
- SOC 2 for fintech and payments
- SOC 2 governance
- SOC 2 for healthcare IT and health BPO
- SOC 2 for payroll companies, HR platforms and staffing firms
- SOC 2 policies and evidence: what you need and what you do not
- The SOC 2 system description: what to write and what to leave out
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice