Most SOC 2 delays come from unidentified gaps—controls that exist informally but lack policy, owner, or evidence. A structured gap process saves months before CPA fieldwork.

Related: Readiness assessment · Audit gaps

Key takeaways

Map Trust Services Criteria → controls → evidence before buying tools.
Rate gaps by risk and audit impact (customer commitments, likelihood, blast radius).
“Fixed” means operating with retrievable evidence—not a Jira ticket closed.
Re-run readiness after major infra or product changes.

How to identify gaps

Select TSC categories and define system boundary.
Use a control library (CC series) aligned to your scope.
For each control, document: policy, procedure, owner, tool, evidence sample.
Mark status: Met / Partial / Not met.

Tools and consultants can accelerate scoring; leadership must still approve scope.

Prioritize remediation

Priority	Examples
P0	No MFA on production, missing logging, no IR plan
P1	Access review not performed, weak vendor reviews
P2	Policy refresh, training backlog

Prove gaps are closed

For each closed gap, retain:

Implementation date
Configuration proof (screenshots/API export)
Policy version and approval
Sample of operating evidence (e.g., two access review cycles for Type 2)

SecureSlate

Track gaps, owners, and evidence in one place: Free trial

Disclaimer (legal note)

Informational only—not audit advice.

How to identify and close gaps in SOC 2 compliance (readiness to remediation)