Free Assessment

Home

  /

  / Drata Agent Guide: Installation, Setup & Sync Troubleshooting

Drata Agent Guide: Installation, Setup & Sync Troubleshooting

Picture of Pedro Dias
Copy Link

The Drata Agent is the part of Drata’s compliance stack that actually touches employee devices. It is a lightweight, read-only desktop application that runs in the system toolbar, reads a narrow set of security configuration settings, and reports them back to the Drata platform on a daily schedule. If a SOC 2 or ISO 27001 audit depends on showing that every endpoint has disk encryption, screen lock, antivirus, a password manager, and automatic updates enabled, the Agent is the thing that produces that evidence.

This guide covers exactly what it does, how it works, how to install it on macOS, Windows, and Linux, and what to do when it stops syncing.

drata agent guide

What Is the Drata Agent?

The Drata Agent is a desktop application built with Electron, the same framework used by Slack, VS Code, and Discord. It uses osquery, an open-source endpoint instrumentation tool created at Facebook and now maintained as a Linux Foundation project, to query the operating system for specific configuration values. The Agent runs from the system toolbar — the menu bar on macOS, the system tray on Windows, and the indicator area on Linux — and synchronises once per day with Drata’s backend.

The full source code of the Agent has been open source since June 2023. Anyone can audit the code on Drata’s GitHub organisation, including security teams that need to validate it before deploying to the fleet.

The Agent supports the latest two major versions of each operating system. On macOS, that currently means macOS 26 (Tahoe) and macOS 15 (Sequoia), with Agent version 3.9.0 or higher. On Windows, it covers the two most recent stable versions Microsoft actively maintains. On Linux, only LTS distributions are supported; Ubuntu 22.04 LTS and 24.04 LTS are the current supported targets.

 

What the Drata Agent Does (and Does Not Do)

The Agent collects a tightly scoped list of configuration data points — specifically the items that map to typical SOC 2 and ISO 27001 device-level controls.

The Agent does read: disk encryption status (FileVault, BitLocker, LUKS); screen lock and screensaver configuration; installed antivirus or endpoint protection software; installed password manager applications; operating system version and update status; the list of installed applications and browser extensions for Chrome, Firefox, and Internet Explorer (used to detect AV and password manager presence); and the operating system identifier and machine serial number for asset attribution.

The Agent does not read keystrokes, browsing history, file contents, clipboard data, screen contents, network traffic, or any application data. Access is strictly read-only at the system-preferences level. The Agent cannot make changes to the device, push configuration, or remediate failed controls. If a check fails, the employee or IT team fixes it manually; the Agent simply observes whether the fix worked on the next sync.

Important: Read-only does not mean invisible. The Agent enumerates installed applications and browser extensions to detect antivirus and password manager presence, and this list is sent to Drata. If that level of visibility is a concern for privacy or works council requirements, address it before rollout — not after.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Schedule

How Does the Drata Agent Work?

Once installed and registered, the Agent runs continuously in the background. It performs scheduled checks, reports results to Drata, and updates itself when new versions ship.

Synchronization Process

The Agent syncs once per day. The sync runs at the first opportunity each calendar day: typically, the first network connection after the device was off or asleep, the moment the user logs in if the Agent autostarts, or any manual trigger from the toolbar menu. The data sent is small — a structured report of the configuration values the Agent read, plus the Agent version and machine identifier. There is no telemetry of user activity.

When the sync succeeds, the device’s compliance status in Drata updates within a few minutes. When it fails, the device may show an Unable to get data status, and the corresponding controls in Drata will appear unconfirmed until the next successful sync.

Automatic Updates

The Agent updates itself. When a new version is released, the Agent shows a notification asking the user to allow the update. Updates are mandatory — running an outdated Agent eventually causes registration and sync failures. Linux installations through Ubuntu’s package manager auto-update via the system updater starting with version 3.6; AppImage installations and Arch AUR builds need to be updated manually or through the AUR helper.

 

Prerequisites Before Installing the Drata Agent

Before installation, three things need to be in place.

First, the device user needs an active Drata account with employee onboarding tasks assigned.

Second, the operating system must be a supported version.

Third, the user needs administrator rights on the device to install the application, since it registers a startup item.

The user will also need access to their work email during installation. Registration uses a magic-link verification flow, and the verification email arrives within a minute of clicking Register Drata Agent in the Drata UI.

Install Drata Agent - Mac

How to Install the Drata Agent on Mac

There are two practical paths on macOS: install through Homebrew Cask, or download the signed installer directly from MyDrata.

Installation via Homebrew

The Drata Agent is published as an official cask in the Homebrew repository, which is the cleanest install method for engineers who already use Homebrew for package management. The cask requires macOS 12 (Monterey) or newer. The install command is:

brew install –cask drata-agent

After Homebrew finishes, open Drata Agent.app from /Applications, then return to MyDrata and click Register Drata Agent. A magic-link email arrives shortly after. Open the link, copy the token portion of the URL, paste it into the Agent’s register dialog, and confirm.

Run or Build the Drata Agent on Mac

For organisations that want to build from source rather than use the published package, the GitHub repository contains the full Electron build pipeline. Build prerequisites include Node.js and electron-builder, and the osquery binaries need to be supplied separately. Drata explicitly notes that locally built packages are not signed and that production registration requires an active Drata account. Self-built Agents are useful primarily for security review, not day-to-day deployment.

How to Install the Drata Agent on Windows

Windows installation is direct download only. There is no official package on Chocolatey, Winget, or the Microsoft Store.

Step-by-Step Windows Installation

Log in to Drata, navigate to My Drata, and expand the Install the Drata Agent task. Select Windows as the operating system. The platform serves a signed .exe installer. Run the installer, accept the standard prompts, and let it complete — the Agent will appear in the system tray.

From the Drata web page, click Register Drata Agent. Open the verification email that arrives in your inbox, click Verify Drata Agent, and follow the prompts to complete registration. The first sync will run shortly after the Agent confirms successful registration.

Pro Tip: After Installation

After installation, the Agent will not sync immediately on its own schedule. Trigger a manual sync from the toolbar menu to confirm the install is working before closing the laptop and walking away.

Install Drata Agent on Linux

How to Install the Drata Agent on Linux

Linux support is the most varied because of the distribution landscape. Drata officially supports Ubuntu LTS releases; community packaging covers Arch.

Ubuntu Linux Installation

For Ubuntu 22.04 LTS or 24.04 LTS, log into Drata, go to My Drata, expand Install the Drata Agent, and choose Linux. The .deb package downloads from the Drata CDN. Install it with the standard apt tooling or by double-clicking through the file manager.

Ubuntu 24.04 introduced AppArmor as a default enforcement layer for many Chromium-based applications, which historically broke Electron apps that did not ship a profile. Drata Agent 3.8.0 and later install with an unconfined AppArmor profile by default, which removes the need for the older– no-sandbox workaround. If strict AppArmor enforcement is required by internal policy, the alternative is to run the Agent as an AppImage — a portable Linux executable format that bundles the application and its dependencies, runs without installing into the system, and sidesteps the AppArmor profile question entirely.

Arch Linux (AUR)

Arch is not officially supported by Drata, but a community-maintained package on the Arch User Repository repackages the official Debian release. With an AUR helper like yay installed, the command is:

yay -S drata-agent

The package’s GitHub Actions pipeline checks the Drata release feed daily and rebuilds when a new version ships. Manual installation via makepkg from a git clone of the AUR repo is also straightforward. Use the AUR package only if internal policy permits unofficial community packaging — otherwise, the AppImage route is closer to a supported path.

Worth Knowing: Ubuntu Users

Ubuntu users still need to upload hard-drive-encryption evidence manually. LUKS configuration is not enumerated by the Agent in the same way FileVault and BitLocker are, so the encryption control on Linux is a manual evidence task in Drata, not an Agent check.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Schedule

Installing the Drata Agent (New Experience)

Drata’s “New Experience” refers to its updated UI rolled out across customer accounts. The installation steps are functionally identical to the legacy flow: open My Drata, expand the Install the Drata Agent task, pick the installer for the operating system, run it, and register through the magic-link email.

The meaningful differences are visual — the task layout has been redesigned, the per-OS installer cards are clearer, and the verification status appears inline in the task pane rather than in a separate dialog. If the account has already migrated to the New Experience, follow the in-product prompts rather than older screenshots.

 

How to Resync the Drata Agent

Manual resync is the first thing to try when device status looks stale. Click the Drata icon in the toolbar — menu bar on macOS, system tray on Windows, indicator area on Linux. The menu shows the Agent’s current status, the timestamp of the last successful sync, and a Resync option. Click it. A successful sync updates the timestamp and pushes new data to Drata within a few minutes.

If the resync triggers an Unable to get data status or fails silently, the issue is usually with registration or network access to Drata’s API endpoints rather than with the Agent itself.

 

Troubleshooting the Drata Agent

Most Agent problems fall into one of three categories: a botched install, a registration that never completed, or a sync that cannot reach Drata’s backend.

Common Installation Issues

On macOS, the most common installation issue is Gatekeeper blocking an unsigned local build — the official Homebrew cask and direct download are signed, so only manually built packages trigger this.

On Windows, the installer occasionally fails when a previous version was uninstalled without removing its registry entries; the fix is to run the uninstaller from Control Panel, delete the residual Drata Agent folder under %LocalAppData%, and reinstall. On Ubuntu, a .deb install can fail if libgconf or other Electron dependencies are missing — running sudo apt –fix-broken install after the failed install usually resolves it.

Agent Not Syncing Correctly

If the Agent installs but does not sync, work through these checks in order. Open the Agent menu and confirm registration shows the user’s email rather than “Not Registered.” If registration is missing, re-run the magic-link flow from MyDrata. Confirm the device can reach *.drata.com over HTTPS — corporate proxies and split-tunnel VPNs are the most common blocker. Trigger a manual resync and watch for the status to update. If the Agent still reports Unable to get data after a fresh registration and a working network connection, capture the device logs and open a support ticket. The Agent has a built-in option to send logs to Drata directly from its menu.

Insider Note: “Unable to get data” almost always points at the Agent failing on one specific osquery check, not a total failure. The Agent reports per-check status, so look at Drata’s device page for which control is failing — it will usually be a screen-lock or AV check where the underlying setting genuinely is misconfigured.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Schedule

Installation Methods at a Glance

Operating System

Supported Method(s)

Notes

 

macOS

Homebrew Cask / Direct download (.dmg)

Homebrew preferred for engineering teams. Requires macOS 15 or 26. Agent 3.9.0+.

Windows

Direct download (.exe)

No package manager support. Clear registry entries if reinstalling.

Ubuntu LTS

.deb package / AppImage

AppImage avoids AppArmor issues on 24.04. LUKS evidence is manual.

Arch Linux

AUR (community, unofficial)

Not officially supported. Use only if internal policy permits.

 

Conclusion

The Drata Agent is a narrowly scoped, read-only observer of device security configuration. It is not an EDR, an MDM, or a remediation tool. Used correctly, it removes the screenshot-and-spreadsheet busywork that used to dominate SOC 2 and ISO 27001 evidence collection, and gives compliance and IT teams a single live view of device control status through automated compliance monitoring.

The install path varies by operating system, but the registration flow is the same everywhere: download, install, click Register in MyDrata, click the magic link, paste the token. When something goes wrong, the manual resync option in the toolbar is the first stop, and the device logs are the second.

Frequently Asked Questions

What data does the Drata Agent collect?

The Agent reads disk encryption status (FileVault, BitLocker, LUKS), screen lock and screensaver settings, installed antivirus software, installed password manager applications, operating system version and update status, the list of installed apps and browser extensions, and the device’s OS identifier and serial number. It does not read keystrokes, file contents, browsing history, network traffic, or any application data.

The Agent has read-only access at the system-preferences level and cannot modify the device. Its source code has been open since June 2023 and is available on GitHub for inspection, and the Agent has been third-party security validated — Drata customers can request the validation report. That said, “safe” is a question that should be answered by an internal security review, not by a vendor claim. The open-source code makes that review possible.

It supports the latest two major versions of macOS, Windows, and Ubuntu LTS. macOS 26 (Tahoe) and macOS 15 (Sequoia) are current. Windows covers the two most recent Microsoft-maintained stable versions. Linux support is limited to LTS distributions — non-LTS releases like Ubuntu 25.10 are explicitly unsupported. Arch Linux is not officially supported but a community AUR package exists.

Open the Agent from the system toolbar. The menu shows registration status, the timestamp of the last successful sync, and the current Agent version. A healthy Agent shows a recent sync timestamp and the user’s email address. Anything else — no email, a stale timestamp, or an Unable to get data message — signals a problem that needs attention.

Once per day. The first opportunity each calendar day is taken — typically on first network connection after sleep or login. Manual resync is available at any time from the toolbar menu.

Yes, through the standard uninstall process for each operating system: Applications folder removal on macOS, Add/Remove Programs on Windows, apt remove drata-agent on Ubuntu, yay -Rns drata-agent on Arch. Uninstalling the Agent removes the device from automated compliance monitoring — the corresponding controls in Drata will need an alternative evidence source, or the Agent will need to be reinstalled.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.
Copy Link

Blog Highlights

Explore More Articles

Read More Blogs

ISO 27001 Consultant vs. Software: Which Is Faster?

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities.  What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

Read more

Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

Read more

The SaaS Founder’s 6-Week SOC 2 Readiness Plan (Free Template)

You can get a SaaS company ready for a SOC 2 audit in six weeks, but you’ll feel every one of them. Most published timelines say three to six months. For a company with no project owner, no identity provider, and nothing written down, that’s about right. A cloud-native startup that already has the basics in place and can protect some time is a different story, and it can fit the work into six hard weeks. This plan walks through that route one week at a time. Each week has an owner, an hour estimate, and a clear test for when it’s finished. The free Google Sheet version turns the plan into a tracker you can hand out to owners and update in your weekly standup. Before you start, know what you’re signing up for. At the end of week 6 you’ll be audit-ready, which isn’t the same as holding a Type II report. Nobody can get you a Type II in six weeks. This is also the do-it-yourself route, and it takes a lot of hours. We’ll show you where those hours go and what the faster option looks like. Is Six Weeks Realistic for Your Company? Six weeks works when most of the plumbing already exists and your job is to formalize it, fill the gaps, and prove it all works. It falls apart when you’re building the foundations and documenting them at the same time. Go through this table honestly before you promise a customer a date. Six weeks is realistic if… Plan for 10 to 16 weeks if… Your product runs on a major cloud provider You host on-premise or across several data centers You already use an identity provider with SSO Every tool has its own login and password You have fewer than about 50 employees You have multiple offices, subsidiaries, or products in scope One named person owns the project with 10 to 15 hours a week Compliance is “everyone’s job,” so in practice nobody owns it An engineer can give you 15 to 20 hours in weeks 3 and 4 Engineering is fully committed to a launch You only need the Security criteria You need Availability, Confidentiality, or Privacy on day one Landing mostly in the right-hand column doesn’t mean you should throw the plan out. Give each week two weeks instead of one and follow the same order. What “SOC 2 Ready” Means at the End of Week 6 SOC 2 doesn’t give you a certificate. An independent CPA firm examines your controls against the AICPA Trust Services Criteria and writes a report, and which of the two report types you go for decides what you can show a buyer after week 6. A Type I report checks whether your controls are designed properly on a single date. Once you’re ready, a Type I audit can start almost right away. A Type II report checks whether those controls kept working over an observation period of at least three months, and usually six to twelve. Most enterprise procurement teams want Type II in the end. Being “ready” at the end of this plan means your in-scope controls are in place, you can pull evidence for any of them on request, and your auditor is booked. From there you either start a Type I audit or open your Type II observation window. Plenty of buyers will sign with a Type I report plus a letter from your auditor saying the Type II period is underway. Important: The Type II clock doesn’t start until your controls are running. If readiness slips by a week, your Type II report slips by a week too. Founders who tell a prospect “we’ll have SOC 2 in Q3” often forget this and end up renegotiating the deal. Before Week 1: Four Decisions to Make First Settle these before the clock starts. If you change any of them halfway through, you’ll redo work. Scope. Decide which systems, teams, and data the report covers. For most SaaS companies that’s the production environment, the code repository, the identity provider, customer data stores, and any support tools that touch customer data. Corporate systems that never see customer data can usually stay out. Trust Services Criteria. Security (also called the Common Criteria) is mandatory. Availability, Confidentiality, Processing Integrity, and Privacy are optional. Report type. Pick Type I if a deal is blocked right now and the buyer will accept it. If there’s no deadline, go straight to Type II. You’ll need it eventually, and skipping Type I saves you an audit fee. Owner and tooling. Name one person who’s accountable for the plan, and decide where your controls and evidence will live. The tooling choice gets its own section below. Pro Tip: Adding Criteria Only add optional criteria when a customer contract or security questionnaire asks for them. Each one brings more controls to set up and more evidence to collect, and you can widen the scope in next year’s audit. Spreadsheet or Compliance Software: Choosing Your Tracking Tool Every SOC 2 program needs a system of record, meaning one place where each control, its owner, its status, and its evidence live. You can run it yourself in a spreadsheet or a GRC platform, or have a consultant implement it for you. The right choice depends mostly on which report you’re after and how much of your team’s time you can spare. A spreadsheet is free and familiar. It also makes you understand your own environment before you automate any of it. For a Type I, or for a small team with a tight scope, a well-built spreadsheet can take you all the way to the audit. Axipro’s free GRC workbook for SOC 2 and ISO 27001 covers all 33 SOC 2 Common Criteria plus the optional criteria, with evidence, risk, policy, and gap trackers built in. It has no macros and opens straight in Google Sheets or Excel. A GRC platform connects to your cloud, identity provider, code repository, and HR system.

Read more