Scope and planning
- Trust Services Criteria chosen: Security, plus any of Availability, Confidentiality, Processing Integrity and Privacy that customers ask for.
- System boundary written down: products, infrastructure, people, processes and data in scope.
- Report type and review period agreed (Type I, or Type II with start and end dates).
- Audit firm selected; it is independent of whoever helps with readiness.
- Executive sponsor named, and an owner assigned to every control.
Governance and policies
- Information security policy approved by leadership and reviewed yearly.
- Supporting policies: acceptable use, access control, change management, incident response, vendor management, data retention.
- Risk assessment performed and documented, with treatment decisions.
- Security awareness training at hire and yearly, with completion records.
- Background checks performed as your policy defines.
Access control
- Single sign-on and multi-factor authentication on production and business-critical systems.
- Role-based access with least privilege, and documented approval for access requests.
- Periodic access reviews with evidence of who reviewed what and what changed.
- Joiner, mover and leaver process tied to HR events; access removed promptly at exit.
- Privileged and production access logged.
Change management
- Peer review required before merge; protected main branch.
- Deployments only through the CI/CD pipeline.
- The author of a change cannot approve it alone.
- Emergency change process documented, with after-the-fact review.
Operations and monitoring
- Central logging with defined retention; security alerts routed to an owner and reviewed.
- Vulnerability scanning with remediation timelines by severity.
- Endpoint protection and disk encryption on company laptops.
- Backups configured and tested by restoring them.
Incident response and continuity
- Incident response plan with roles, contacts and customer notification steps.
- Tabletop exercise run and documented.
- Business continuity and disaster recovery plan, tested.
Vendors and data
- Inventory of vendors that store or process customer data.
- Risk review before onboarding a vendor; SOC 2 or equivalent reports collected for critical vendors.
- Data classification defined; encryption in transit and at rest.
- Retention and secure disposal schedule followed.
Before the review period opens
- Readiness assessment complete and gaps closed.
- Evidence collection automated from systems of record where possible.
- System description drafted and checked against reality.
- Kickoff scheduled with the auditor; evidence request list agreed.