SOC 2 Readiness IT Support in Reno
SOC 2 is an attestation report on a service company's controls, issued by an independent CPA firm under AICPA standards. Computer Services Reno helps Reno, Sparks and Carson City businesses get the IT side ready: access reviews, MFA, device management, change logs, backups and onboarding records. We do not issue reports or audit.
What is SOC 2?
SOC 2 is one of the AICPA's System and Organization Controls reports. A licensed, independent CPA firm examines a service organization's controls against the AICPA's Trust Services Criteria and issues a report the company can share with its customers.1
It is not a law or a government certification. Businesses pursue it because customers ask: a larger client's security questionnaire or contract says "send us your SOC 2 report", and without one the deal slows down or stops.
Because only a CPA firm can issue the report, the people who help you prepare and the people who audit you are separate. That split is by design.
Which Trust Services Criteria does SOC 2 cover?
There are five categories:1
- Security (required in every SOC 2): protection of systems and data against unauthorized access and use. These are often called the common criteria.
- Availability (optional): systems are available for operation as committed.
- Processing integrity (optional): processing is complete, accurate and authorized.
- Confidentiality (optional): information marked confidential is protected.
- Privacy (optional): personal information is collected, used and disposed of as committed.
Most small companies start with security alone and add others only when customers ask.
SOC 2 Type I vs Type II: which do you need?
The type sets what the auditor tests and how much evidence you need. Your customers' contracts often decide it for you.
| Question | Type I | Type II |
|---|---|---|
| What it tests | Whether controls are suitably designed and in place | Whether controls are designed and operated effectively |
| Time covered | A single point in time | A review period, often several months to a year |
| Evidence needed | Configurations, policies and a snapshot of controls | Records showing each control ran throughout the period |
| Typical use | A first report, or a quick answer to a new customer | What larger customers usually expect over time |
| Where IT records matter most | Showing settings such as MFA and encryption are on | Showing access reviews, patching and backup tests happened on schedule |
How does IT support help with SOC 2 compliance?
A large share of the security criteria covers access, change, system operations and risk mitigation, which is everyday IT work. As part of managed IT services, we set up and maintain these controls and keep the records.
Access reviews
Lists of who has access to which systems and who holds admin rights, ready for a periodic review your team signs off.
Multi-factor sign-in
MFA turned on for email, cloud apps and admin accounts, with a record of where it is enforced.
Device management
An inventory of company computers with encryption, screen lock and updates applied and tracked.
Change logs
A dated record of changes we make to servers, network equipment and key settings.
Backups and restore tests
Monitored backup and disaster recovery with dated restore tests, which also supports the availability criteria.
Onboarding and offboarding
Records showing accounts were created with the right access and removed when people left.
Much of this lives in your Microsoft 365 tenant. Our Microsoft 365 support covers the account, sign-in and device settings auditors ask about most.
What stays with your business and your auditor?
Computer Services Reno does not issue SOC 2 reports and does not act as an auditor. We are not a CPA firm. Your business picks the scope, writes the policies, runs the risk assessment, assigns control owners and hires the CPA firm. The CPA firm performs the examination and issues the report.
Our part is the technical controls and the evidence they produce. Keeping those two jobs separate also keeps the audit clean: the people who run a control should not be the ones attesting to it.
Do other compliance rules overlap with SOC 2?
Often, yes. A company that handles patient data for clinics may also need HIPAA IT compliance, and one that serves tax preparers or lenders may be asked about the FTC Safeguards Rule. MFA, encryption, access reviews and tested backups count toward all three, so one set of well-kept IT records can answer several audits and questionnaires. Each rule still has its own legal requirements, which your advisors should map.
What should be in place before a SOC 2 audit?
- A defined scope: which systems, data and Trust Services Criteria
- Written security policies approved by leadership
- A risk assessment and a named owner for each control
- Individual accounts and MFA on systems in scope
- Encrypted, managed company computers
- Access reviews on a set schedule, with sign-off
- Change records and patching history
- Backup and restore test records
- Onboarding and offboarding records for each hire and departure
- Vendor list with each vendor's security documents
How do you start SOC 2 readiness?
Check the IT basics
Our free on-site IT assessment looks at your computers, network, backups and security and gives you a prioritized fix list. It is not a SOC 2 readiness assessment, but it shows where the technical gaps are.
Close gaps and start the records
Turn on MFA, encrypt devices and begin logging access reviews and changes. A Type II period can only start once controls are running.
Keep it running
Controls have to keep operating between audits. See managed IT pricing, or the IT compliance overview for how we split the work.
This page is general information, not legal advice.
SOC 2 readiness FAQ
See where your IT stands, at your office.
Book a free on-site IT assessment. A local technician comes to you, looks at your setup, and gives you a plain-English list of what to fix first. No cost, no contract.