/type-ii-planner

description: Plan SOC 2 Type II period testing timeline

SOC 2 Type II Planner

Generates a detailed timeline and checklist for SOC 2 Type II audit period testing, including evidence collection schedules, review milestones, and readiness gates.

Usage

/soc2:type-ii-planner <period-start> <period-end> [options]

Arguments

• `$1` - Period start date (format: YYYY-MM-DD)
• `$2` - Period end date (format: YYYY-MM-DD)
• `$3` - Options: `--audit-firm=name`, `--output=format` (timeline, checklist, gantt)

Examples

# Standard 12-month period
/soc2:type-ii-planner 2024-01-01 2024-12-31

# 6-month period (minimum)
/soc2:type-ii-planner 2024-07-01 2024-12-31

# With audit firm and Gantt output
/soc2:type-ii-planner 2024-01-01 2024-12-31 --audit-firm="Example Audit LLP" --output=gantt

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOC 2 TYPE II AUDIT TIMELINE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Audit Period: January 1, 2024 - December 31, 2024 (12 months)
Audit Firm: [To be selected]
Estimated Audit Start: January 2025
Report Date: March 2025 (target)

Period Requirements:
✓ Minimum duration: 6 months (AICPA requirement)
✓ Selected duration: 12 months (standard for first-time)
✓ Controls must be operating for entire period
✓ Evidence required from all months

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
READINESS TIMELINE (Pre-Period)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3 Months Before Period Start (Oct 2023):
□ Complete SOC 2 readiness assessment
  Command: /soc2:assess security type2
  Output: Identifies gaps in controls/processes

□ Select Trust Service Criteria
  Required: Security (CC1-CC9)
  Optional: Availability, Confidentiality, Processing Integrity, Privacy
  Decision: Document scope in System Description

□ Implement missing controls
  Priority: All Type A (design) deficiencies
  Timeline: Must be operational by period start

□ Document policies and procedures
  Required: All control policies
  Approval: Executive management sign-off
  Version: Must be dated before period start

□ Set up evidence collection automation
  Command: /grc-engineer:monitor-continuous SOC2 daily
  Purpose: Continuous evidence collection

2 Months Before (Nov 2023):
□ Select and engage audit firm
  RFP Process: Get quotes from 3+ firms
  Budget: $15k-$50k depending on complexity
  Deliverables: Type II report, management letter

□ Conduct readiness audit (optional but recommended)
  Purpose: Identify issues before official audit
  Scope: Design testing only (point-in-time)
  Cost: ~30% of full audit cost

□ Train staff on control procedures
  Audience: All personnel involved in controls
  Topics: Evidence collection, quarterly reviews, incident response

1 Month Before (Dec 2023):
□ Perform dry-run of quarterly reviews
  Purpose: Validate process before period start
  Evidence: Practice access reviews, change management reviews

□ Verify automated evidence collection
  Test: Ensure logs, reports generating correctly
  Retention: Configure 1+ year retention

□ Finalize System Description
  Content: Infrastructure, processes, controls
  Review: Internal legal, IT, security review
  Approval: Management sign-off

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AUDIT PERIOD (Jan 1 - Dec 31, 2024)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Month 1 - January 2024:
✓ Period Start - Day 1 (Jan 1)
  - All controls must be operating
  - Policies/procedures in effect
  - Evidence collection begins

□ Q1 Activities:
  - Quarterly access review (due: Jan 31)
  - Vulnerability scans (weekly)
  - Change management board meetings (weekly)
  - Security awareness training (monthly)
  - Incident response testing (quarterly)

□ Evidence Collection:
  - Save all access request tickets
  - Document all changes (CAB minutes)
  - Collect vulnerability scan results
  - Maintain security training records

Month 2 - February 2024:
□ Monthly checkpoint
  - Review evidence collection completeness
  - Verify no control gaps/outages
  - Document any incidents/exceptions

Month 3 - March 2024:
□ End of Q1 - Major Milestone
  ✓ First quarter complete
  ✓ Quarterly access review completed
  ✓ Quarterly management review completed
  ✓ All Q1 evidence collected and organized

Month 4-6 (Apr-Jun 2024) - Q2:
□ Q2 Activities (same as Q1)
□ Mid-period review (internal)
  - Verify controls still operating
  - Check evidence completeness
  - Identify any gaps early

□ End of Q2 (June 30):
  ✓ Halfway through period
  ✓ Second quarterly reviews complete
  ✓ 6-month minimum achieved (early exit possible if needed)

Month 7-9 (Jul-Sep 2024) - Q3:
□ Q3 Activities (same as Q1/Q2)
□ Pre-audit preparation begins
  - Contact audit firm for scheduling
  - Begin organizing evidence
  - Identify PBC (Provided By Client) list

□ End of Q3 (Sept 30):
  ✓ Third quarterly reviews complete
  ✓ Prepare for final quarter

Month 10-12 (Oct-Dec 2024) - Q4:
□ Q4 Activities (same as Q1/Q2/Q3)
□ Final month activities:
  - Complete all quarterly reviews
  - Collect final month evidence
  - Prepare comprehensive evidence package

✓ Period End - Day 365 (Dec 31)
  - All controls must operate through final day
  - Final evidence collection
  - Period complete

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
POST-PERIOD (Jan-Mar 2025)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Week 1-2 (Early Jan 2025):
□ Evidence Package Preparation
  Command: /soc2:service-auditor-prep --period 2024
  Output: Complete evidence package

□ Organize evidence by control
  Structure: ./evidence/[control-id]/
  Contents: Policies, automated evidence, manual samples

□ Finalize System Description
  Update: Any changes during period
  Approval: Final management sign-off

Week 3-4 (Mid-Late Jan 2025):
□ Audit Kickoff Meeting
  Attendees: Audit firm, IT, Security, Management
  Agenda: Scope, timeline, evidence location, key contacts

□ Provide PBC (Provided By Client) List
  Cont