SOC 2 audits have a way of landing on RevOps teams without much warning. Security sends a questionnaire, auditors request evidence, and suddenly you are being asked to prove that your CRM automations are documented, your data access is controlled, and your integrations don't leak PII into unexpected places. If you haven't done this before, the scope can feel overwhelming.
This post is a working checklist, not a compliance primer. It assumes you already know what SOC 2 is and focuses on the specific systems, processes, and evidence artifacts that RevOps teams are typically responsible for during a Type 1 or Type 2 audit.
1. Map Every System Your Team Owns or Touches
Before auditors ask, you need a complete inventory of the tools in your revenue stack that store or process customer or prospect data. This includes your CRM, marketing automation platform, sales engagement tools, enrichment vendors, data warehouses, and any point-to-point integrations connecting them.
For each system, document:
- Who owns the account (named admin)
- What categories of data it holds (contact info, firmographic, behavioral, financial)
- Whether it syncs data out to other tools and where that data lands
- Whether the vendor has their own SOC 2 report (your auditors will ask)
This inventory becomes the foundation for your access control review and your data flow diagrams. If your automation platform runs hundreds of workflows, a visual dependency map can shortcut the discovery work by showing exactly which workflows touch which data objects and feed which downstream systems.
Don't Forget Point-to-Point Integrations
Native integrations through your CRM's marketplace are easy to overlook because they don't require a separate vendor contract. But if an integration is passing contact records to a third-party enrichment service, that data flow needs to be in scope. List every installed app or connector, check what OAuth scopes it uses, and verify whether the vendor appears on your vendor risk register.
2. Audit Data Access and User Permissions
SOC 2 Trust Service Criteria around logical access (CC6.1 through CC6.8 in the 2017 framework) require you to demonstrate that only authorized users have access to systems and data, and that access is reviewed and revoked promptly when roles change.
For RevOps, this means running a full user audit across every platform you manage. For each tool, produce a report showing:
- All active users and their permission levels
- The date each user was provisioned
- Any super-admin or billing-level access granted to individual contributors
- Users who have left the company but still have active logins
Pay particular attention to shared credentials and service accounts used by integrations. These are common audit findings because they are hard to tie to a named individual. Every service account should have a documented owner and a purpose.
Implement a Quarterly Access Review Process
Auditors don't just want a point-in-time snapshot. For SOC 2 Type 2, you need evidence that access reviews happen on a recurring schedule. Build a lightweight process: export user lists quarterly, route them to team leads for sign-off, and store the approved exports in a shared location with timestamps. Even a simple spreadsheet workflow with dated approvals will satisfy most auditors if it's consistent.
3. Document Your Automations and Change Processes
This is where RevOps teams often have the most exposure. Hundreds of active workflows, assignment rules, and data sync configurations represent real business logic, but if they aren't documented, auditors will flag the absence of change management controls.
SOC 2 Change Management criteria (CC8.1) require you to demonstrate that changes to systems are authorized, tested, and documented before being deployed. For marketing and sales automation, that means:
- Keeping a record of who created or last modified each workflow
- Documenting the business purpose of each automation
- Showing evidence of testing or peer review before major changes go live
- Tracking when automations are deprecated or turned off
A manual documentation effort across a large automation instance is painful. Tools that provide an automatic changelog for every modification to your workflows give you audit-ready evidence without requiring a separate documentation discipline.
Prioritize High-Risk Automations First
Not every workflow carries the same risk profile. For documentation purposes, prioritize automations that:
- Modify or delete contact or company records
- Trigger external API calls or data exports
- Control lead routing or deal assignment
- Send communications on behalf of your company
These are the workflows most likely to surface during an audit and the ones where a change without documentation creates the most exposure.
4. Review Data Retention and Deletion Practices
SOC 2 doesn't prescribe specific retention periods, but auditors will look for evidence that you have a defined policy and that your systems enforce it. For RevOps, data retention questions typically surface around:
- How long you keep records of prospects who never converted
- What happens to contact data when a customer churns or requests deletion
- Whether form submissions and behavioral event data are subject to a retention limit
- How unsubscribe and data deletion requests flow through your systems
If your CRM holds records going back ten years with no archival or deletion policy, that's a finding waiting to happen. Work with your legal and security teams to agree on retention windows, then document the process for honoring deletion requests end-to-end, including how those deletions propagate to connected tools.
Build a Data Subject Request Runbook
When a prospect or customer submits a data deletion or access request, you need a documented runbook that your team can follow consistently. The runbook should name who receives the request, which systems need to be checked, the maximum response time, and how completion is logged. Having this written down, even informally, is significantly better than having nothing at all when an auditor asks how you handle it.
5. Prepare Evidence in Advance
The single biggest mistake RevOps teams make during SOC 2 prep is treating it as a reactive exercise. Auditors request evidence, and teams scramble to find exports, screenshots, and email threads that prove controls exist. This creates stress and risks gaps in the record.
Instead, build a standing evidence folder that you update on a defined cadence. Typical artifacts RevOps is responsible for include:
- User access reports with sign-off dates (quarterly)
- Workflow change logs or version history exports
- Vendor SOC 2 reports for each tool in your stack (annually)
- Data flow diagrams showing how customer data moves between systems
- Incident or anomaly logs for any automation failures that touched customer data
If your team manages a complex automation environment, a RevOps documentation canvas can help you keep technical documentation organized in one place rather than scattered across Notion pages, Confluence docs, and email threads.
SOC 2 prep is ultimately about demonstrating that your revenue systems are managed with intention. The teams that pass with the fewest findings are the ones who have already been doing the work. Start the inventory, lock down access reviews, and document your automations now, before the auditors schedule their first call.
Top comments (0)