← All calendars
SOC 2 · 17 RECURRING ACTIVITIES

SOC 2 Compliance Calendar — every recurring control, mapped to TSC

A clean Type I is one auditor visit. Type II is twelve months of evidence. This calendar lists every recurring SOC 2 control with cadence, owner, effort, and exact TSC reference — so the observation window doesn't surprise you.

Cadence mix:2× Weekly4× Monthly3× Quarterly1× Every 6 months5× Annually2× Event-triggered
Who this is for
  • Engineering / SRE leads operationalising Type II evidence collection
  • Security or GRC leads after a clean Type I, entering observation window
  • Founders building first SOC 2 program who need a 12-month roadmap
Typical effort
Plan ~80–160 person-hours/yr for a small startup; 250–500 hrs for a 50–200 person company.

The calendar

Weekly (2)

Review SIEM / security alerts triage
Logging & Monitoring
Triage all P1/P2 alerts, document closure or escalate. Skipped weeks = blown CC7.2 evidence.
Reference
TSC CC7.2
Owner
Security on-call
Effort
1–2 hrs
Evidence
Ticket / Slack thread per alert
Confirm every prod change has an approved PR + ticket
Change Management
Spot-check the merge queue: PR linked to Jira/Linear, code review, no self-merge to main without override.
Reference
TSC CC8.1
Owner
Eng manager
Effort
30 min
Evidence
PR + ticket linkage

Monthly (4)

Review failed-login + MFA-bypass anomalies
Logical Access
Pull failed-login spikes from Okta/Workspace; investigate any successful logins from unusual geos.
Reference
TSC CC6.1, CC7.2
Owner
Security
Effort
1–2 hrs
Evidence
Anomaly review doc
Run + remediate vulnerability scans
Vulnerability Mgmt
Critical/High patched within SLA (typ. 14d critical, 30d high). Track exceptions in risk register.
Reference
TSC CC7.1
Owner
DevOps
Effort
4–8 hrs
Evidence
Scan report + patch tickets
Verify backups completed + integrity-check sample
Backup & Recovery
Confirm backup success in RDS/S3/etc., restore one sample backup to a sandbox, document.
Reference
TSC A1.2
Owner
DevOps
Effort
2–3 hrs
Evidence
Backup report + restore log
Monitor Tier-1 vendors for breach / outage news
Vendor / Third-party
Watch security news + vendor trust pages for SOC 2 / ISO renewals + incidents.
Reference
TSC CC9.2
Owner
GRC
Effort
1 hr
Evidence
Monitoring log

Quarterly (3)

Privileged + production access review
Logical Access
Manager certifies every user with prod / admin / IAM access. Stale accounts removed within 5 business days.
Reference
TSC CC6.2, CC6.3
Owner
Manager + IT
Effort
4–6 hrs/qtr
Evidence
Signed access review report
Internal control walkthrough — 5 to 10 sample controls
Internal Controls
Pick controls, walk evidence end-to-end. Findings → remediation tickets with SLA.
Reference
TSC CC4.1, CC4.2
Owner
Internal audit / GRC
Effort
8–12 hrs
Evidence
Walkthrough memo + tickets
Vendor risk re-tier + Tier-1 attestation refresh
Risk
Re-score vendors that changed scope; refresh SOC 2 / pen-test reports for Tier-1; update vendor register.
Reference
TSC CC9.2
Owner
GRC
Effort
4–6 hrs
Evidence
Updated vendor register

Every 6 months (1)

Disaster recovery / BCP test
Resilience
Failover at least one critical service; measure RTO/RPO; document gaps; update runbook.
Reference
TSC A1.3
Owner
DevOps + Eng
Effort
8–16 hrs
Evidence
DR test report

Annually (5)

Enterprise risk assessment
Risk
Refresh threat / likelihood / impact register; document treatment + owner; reviewed by leadership.
Reference
TSC CC3.1, CC3.2
Owner
Security + Exec
Effort
16–24 hrs
Evidence
Risk register + leadership signoff
Policy review + acknowledgement cycle
Policies
Every policy reviewed, version-bumped, and re-acknowledged by all employees within 30 days of refresh.
Reference
TSC CC2.2, CC5.3
Owner
GRC + HR
Effort
8–12 hrs
Evidence
Acknowledgement records
Security awareness training — 100% completion
Training
Required for every employee + contractor with system access. Track to 100% before audit cutoff.
Reference
TSC CC1.4, CC2.2
Owner
HR + Security
Effort
4 hrs admin
Evidence
Training completion report
Tabletop incident response exercise
Incident Response
Simulate ransomware / data-leak scenario with named team. Measure decision time, escalation, customer-comms quality.
Reference
TSC CC7.3, CC7.4
Owner
Security + Eng + Legal
Effort
4–6 hrs + prep
Evidence
Tabletop after-action report
Independent network + app penetration test
Pen Test
External CREST / OSCP firm; remediate Critical/High before audit close.
Reference
TSC CC7.1
Owner
Security + 3rd-party
Effort
Vendor-led + ~16 hrs internal
Evidence
Pen-test report + remediation

Event-triggered (2)

Security incident — invoke IR plan
Incident Response
Any confirmed security event: open ticket, assemble responders, notify per breach-notification timelines, post-mortem.
Reference
TSC CC7.3, CC7.4, CC7.5
Owner
Incident commander
Effort
Variable
Evidence
Incident ticket + post-mortem
Major architecture change — risk review
Change Mgmt
Any change touching auth, data classification, network egress, or vendor scope: documented risk review before merge.
Reference
TSC CC8.1
Owner
Eng + Security
Effort
2–4 hrs
Evidence
Architecture review doc

Pitfalls — where teams actually fail

Want this calendar mapped to YOUR controls?

Drop your existing SOC 2 policy or upload a draft — ComplianceIQ scores it against the framework and produces a 0–100 audit, gap-by-gap with the cadence work you're missing.

Run free SOC 2 audit See readiness checklist

What happens when the cadence slips — real SOC 2 actions

$148M
Uber · 2018
$80M + $190M class
Capital One · 2020

FAQ

Do all of these run continuously during the Type II observation window?
Yes — Type II observes operating effectiveness over 6–12 months. The auditor will sample evidence from random months, so any cadence you skip can become an exception.
Can we tool this with Drata / Vanta / Secureframe?
Yes for evidence collection (access reviews, MFA enforcement, scan reports). No tool replaces the manager-signed access review, the tabletop, or the management review — the human signoff is the control.
What's the difference between Type I and Type II for ongoing cadence?
Type I attests controls exist on a single date. Type II attests they operated over time — meaning every recurring item in this calendar must be evidenced through the observation window.
Do we need quarterly access reviews if we have automated provisioning?
Yes. Automated provisioning addresses joiner/mover/leaver risk, but auditors still expect manager-attested certification of who currently holds privileged access — automation alone fails CC6.2.

Other calendars

ISO 27001:2022 Compliance Calendar
14 items · ISO 27001
HIPAA Compliance Calendar (Security & Privacy Rule)
15 items · HIPAA
GDPR Compliance Calendar
15 items · GDPR
PCI DSS 4.0.1 Compliance Calendar
16 items · PCI DSS 4.0.1