How to Pass SOC 2 Type 2: A Practical Roadmap (AWS)

Originally published at sahildubey.us

Type 2 isn't a test you cram for — it proves your controls operated over months. After 16 years building AWS platforms and taking them through SOC 2, PCI DSS and ISO 27001 audits (CISA, CISM, AWS Solutions Architect Professional), here's the sequence that gets you to a clean report without a fire drill.

Type 1 vs Type 2 in one line

Type 1 says your controls are designed correctly at a point in time. Type 2 proves they actually operated over a period — commonly three to twelve months. Type 2 is what most enterprise buyers want, and you can't cram for it: the evidence is generated by controls running day after day.

The roadmap

1. Scope and select criteria

Decide which Trust Services Criteria apply. Security (the Common Criteria) is mandatory; add Availability, Confidentiality, Processing Integrity or Privacy only if they're relevant to your service.

1. Gap assessment

Compare current state to the criteria and produce a prioritised gap register. This is where you learn how far off you really are.

1. Remediate and implement in AWS

Turn gaps into real controls: least-privilege IAM and MFA, KMS encryption, CloudTrail and Config, change management through a reviewed CI/CD pipeline, backups with tested restore.

1. Automate evidence

Wire controls so they emit evidence automatically — access reviews, pipeline logs, config snapshots — instead of screenshotting things the night before fieldwork.

1. Pick the observation window

Choose the window (often three to six months for a first Type 2). Controls must operate for the whole period.

1. Operate and monitor

Run the controls, catch drift, remediate on an SLA. Consistency over the window is what the auditor tests.

1. Auditor fieldwork

The auditor samples evidence across the window and writes the report. Clean evidence collected all along makes this fast.

The controls auditors actually check
Domain AWS control Evidence
Access IAM least-privilege, MFA, SSO Access-review exports, no long-lived keys
Change mgmt Reviewed CI/CD, IaC Pipeline logs, PR approvals
Monitoring CloudTrail, Config, GuardDuty Log retention, alerts fired
Encryption KMS at rest & in transit Key policies, TLS config
Resilience Backups + tested restore Backup schedule, restore test
Why teams fail (or stall)
Treating it as a document exercise while the account tells a different story.
Collecting evidence manually and burning out before the window ends.
Controls that work in one region but are switched off in another.
No one owning remediation, so drift accumulates.
My take

The teams that pass Type 2 the first time don't work harder during fieldwork — they front-loaded the controls and automated the evidence, so the observation window ran itself. Build it right once, then let it operate.

I'm Sahil Dubey — DevOps, cloud & compliance architect (CISA, CISM, AWS SA Pro). Full version with FAQ: How to pass SOC 2 Type 2, more at sahildubey.us.