SOC 2 has a reputation for being difficult and complex. You could argue that this is by design, since you need help from a small group of top-notch, pricey experts to be compliant. A kinder view is that it’s just how info security operates (there’s no one-size-fits-all fix). To set up the right protections, a company has to either create them according to the risks they face, or narrow down a huge list of possible controls, again, considering the risks. In a nutshell, SOC 2 goes with the first option: it sets broad criteria and lets each organization come up with controls to meet those criteria, based on their unique risks. Sounds reasonable, but it’s not exactly a walk in the park for those who aren’t experts. That’s where both workflow automation and compliance automation software can come in handy. In this post I’ll introduce you to Drata and Process Street, two essential tools that, when used together, provide a complete solution to help you speed up and simplify your yearly SOC 2 compliance.

1. 1/9
April 17, 2023
SOC 2 Compliance Made Easy (with Process Street &
Drata)
process.st/soc-2-compliance-software
Oliver Peterson
April 17, 2023
Business Operations
SOC 2 has a reputation for being difficult and complex. You could argue that this is by
design, since you need help from a small group of top-notch, pricey experts to be
compliant.
A kinder view is that it’s just how info security operates (there’s no one-size-fits-all fix).
To set up the right protections, a company has to either create them according to the risks
they face, or narrow down a huge list of possible controls, again, considering the risks.
In a nutshell, SOC 2 goes with the first option: it sets broad criteria and lets each
organization come up with controls to meet those criteria, based on their unique risks.
Sounds reasonable, but it’s not exactly a walk in the park for those who aren’t experts.
That’s where both workflow automation and compliance automation software can come in
handy.

2. 2/9
In this post I’ll introduce you to Drata and Process Street, two essential tools that, when
used together, provide a complete solution to help you speed up and simplify your yearly
SOC 2 compliance.
Your main challenges with SOC 2 compliance
When you’re trying to achieve SOC 2 compliance, you’ve got a few problems to solve:
Challenge #1: Resource constraints
Problem: SOC 2 compliance can be a real resource hog, taking up a lot of time, money,
and people power.
Solution: Use automation tools to improve efficiency and save money.
You can reduce workload by automating compliance tasks using a tool like Drata.
Similarly, workflow automation software like Process Street can help you lower
operational costs by streamlining tasks like security and performance reviews into handy,
simple checklists that can be used as evidence in a SOC 2 audit.
Challenge #2: Lack of expertise
Problem: Most organizations don’t have experts in-house who know how to navigate the
SOC 2 compliance process, leading to confusion and frustration.
Solution: Capture expertise in process management templates.
Hire or train personnel with the necessary expertise to guide your organization through
the SOC 2 compliance process. Then capture that information into a workflow template to
help save costs and improve success rates on recurring audits.
Challenge #3: Complexity of criteria
Problem: The SOC 2 criteria can be super confusing and hard to understand, making it
tough to know what applies to your organization.
Solution: Reduce human error & make it easy for non-experts to follow complex
processes with templates and workflow management tools.
Work with a qualified third-party vendor to help interpret and apply the SOC 2 criteria to
your organization’s specific situation, while leveraging templates and process
management tools to scale the expertise of the qualified 3rd party vendor.
Challenge #4: Audit scope
Problem: Figuring out the audit’s scope can be a real pain because it requires a deep
understanding of how your organization’s systems and operations work.
Solution: Maintain consistent process & policy documentation.

3. 3/9
If you take process documentation seriously in your organization, you will already have a
clear overview of internal processes. This provides a great starting point for your vendor
partner to define the scope of the audit.
Challenge #5: Security gaps in processes
Problem: The audit process may uncover gaps in your controls that you’ll need to fix,
which can take a lot of time and effort.
Solution: Use process management tools to improve process control.
Workflow management software makes editing operational processes quick and painless.
Need to tighten up permissions or see an overview of users contributing to a process? It’s
easy with Process Street.
Challenge #6: Ongoing maintenance
Problem: Achieving SOC 2 compliance isn’t a one-time deal; you’ll need to keep
monitoring and maintaining your systems and controls to stay compliant.
Solution: Use workflows and templates to streamline recurring reports.
Workflow Templates and Runs make recurring processes like SOC 2 reports simple and
easy to execute. If you document workflows for all relevant reviews in Process Street
during your first audit, you can re-use them in subsequent audits to complete them even
faster.
Essential tools for efficient SOC 2 compliance
The simple answer is that most of the solutions to common SOC 2 challenges can be
solved with the appropriate toolkit.
To automate tasks you need a system for electronic process documentation &
management, and you need to make sure your core processes are already documented.
To properly implement templates you either need time to build them from scratch or
access to versatile pre-made template libraries or help from process-building experts.
Let’s look at some essential tools that can help make SOC 2 compliance faster and easier
than ever before.
Drata: Designed by auditors and security experts for ease of use
Drata is a security and compliance automation platform. It’s specifically designed to help
businesses meet SOC 2 compliance while operating.
Drata is an essential tool for SOC 2 compliance because it:
Reduces compliance costs with automation.

4. 4/9
Has quick-start capabilities to get you up and running in minutes.
Eliminates spreadsheets and time-consuming tasks for streamlined audits
Automatically collects evidence via 75+ integrations with your existing tech stack.
Comes with 20+ editable, auditor-approved security policies.
In a nutshell, Drata is set up to continuously monitor and collect proof of an
organization’s systems and controls while simultaneously streamlining compliance
reports to ensure audit readiness.
Drata also helps automate compliance with ISO 27001, GDPR, HIPAA, and PCI DSS.
The main shortcoming of Drata is that it doesn’t always give a way for you to generate the
necessary evidence for a compliance policy or procedure.
For example, you need to test your disaster recovery plan every year. Drata can store the
plan as a static .PDF, but it has no way for you to run it and show evidence you ran it.
Other SOC 2 compliance tools focused on the process management side, like Process
Street, are excellent for making SOC 2 compliance actionable.
You can schedule and perform these annual processes inside Process Street and then
upload the completed process reports into Drata as evidence for the SOC 2 auditor.
Process Street: Workflows to automate tasks & capture expertise
Process Street is a cloud-based workflow software that can help you streamline and
automate the SOC 2 compliance process by:
Clearly documenting your core processes for audit scope.
Quickly & easily creating workflows to check policy compliance.
Templatizing and automating recurring work to reduce human error.
Making it easy to edit and improve your processes.
Improving audit transparency by recording who did what (and when) in a Workflow
Run.
Allowing you to schedule recurring compliance procedures to ensure you don’t miss
deadlines.
Automatically generating audit evidence by exporting Workflow Runs.
Workflow Runs can then be uploaded to Drata’s compliance management platform
for ongoing compliance tracking and reporting.
At Process Street, we even use our own platform together with Drata to achieve
SOC 2 compliance! We’re constantly striving to help our customers achieve and
maintain SOC 2 compliance, too.
Why use compliance automation software?

5. 5/9
The main reason for using compliance automation software is to remain SOC 2 compliant.
In the past, SOC 2 compliance was a taxing process that had auditors watching the way
businesses operated for significantly longer periods, to evaluate if a business was, in fact,
compliant.
It’s easier, quicker and more reliable to use software that ensures you remain compliant
the entire year. This way, you don’t need to rush and play catch-up to become compliant
again when it comes time for your next audit.
Benefits of using a complete SOC 2 compliance solution
Together, Drata + Process Street provide a complete solution to achieving and
maintaining SOC 2 compliance.
Automated reminders about SOC 2 compliance tasks
“Every time we hire a new employee, I will immediately receive an alert from Process Street
saying that there’s a new employee and that I need to do A, B and C by a certain date.”
– Gabriel Labrada on how Process Street helps improve visibility on SOC 2 compliance
tasks
When it comes time to do these annual tests, Process Street’s scheduled workflows are
triggered and notifications go out to ensure we meet the deadlines in a timely manner.
For example, when Drata notifies us that we need to conduct our annual Disaster
Recovery Plan, the respective Process Street Disaster Recovery Plan Workflow is run and
the security manager can work through the various tasks involved in the test until it’s
successfully completed.
Once these workflows are complete, the reports can be saved and uploaded into Drata to
prove that the procedures have been conducted successfully.
Onboard new hires into security training programs
Drata’s built-in security training functions let you automate tasks to send out reminders
regarding document completion. This security training comes in handy whenever we hire
a new employee here at Process Street.
“Security training is never a one-and-done. Employees need to be part of the SOC 2
conversation from the get-go. Curricula is a compelling way to make security education fun
so employees actually learn from their training.”
– Adam Markowitz, CEO of Drata
Our onboarding workflow welcomes new hires into our organization. It takes them
through the entire employee onboarding journey, and includes a task to get them set up
with Drata.

6. 6/9
From here, Drata takes the new employee through:
Configuring their computer
Installing the recommended password manager
Encrypting their hard-disk
Installing anti-virus/malware software
Enabling automatic updates
Applying a lock to their screen saver
Both the security manager and employee get notified if these tasks are incomplete or out
of compliance.
Generate SOC 2 evidence on-the-go, automatically
“We noticed while doing our SOC 2 compliance that many of the requirements were
recurring processes. Each of these procedures had a list of steps that needed to be followed.
Then, at the end, you needed a hard copy as evidence, generally a PDF.
That’s when it became clear that Process Street would be a perfect fit. With Process Street,
you can create a workflow that specifies what needs to be done, schedule it to be run each
year, and then export the resulting run as evidence.”
– Cameron McKay, CO-Founder and CTO of Process Street
Along with monitoring your control systems to ensure you’re constantly compliant, Drata
also reminds you about any annual procedures that need to be completed.
But it’s on you to get those procedures done and then upload supporting evidence.
That’s where Process Street is handy – you can export Workflow Runs and submit those
as evidence that a procedure has been completed. It’ll contain all of the information
relevant to the SOC 2 audit such as who completed the procedure, when it was completed,
and if there was any additional information recorded in form fields.
Crystal clear process documentation
Running annual procedures for SOC 2 compliance manually involves following
documented processes that address the relevant trust principles and meet the criteria
established by the AICPA.
To do this you might develop checklists or spreadsheets to document the procedures,
track progress, and assign specific responsibilities to individuals or teams within your
organization.
You need your processes clearly defined and documented. That’s so the auditor
understands the scope of core processes used in your organization.

7. 7/9
If you’re using Process Street, having your processes documented means you can easily
generate evidence, too.
Here are some of the procedures you’ll need to follow to be SOC 2 compliant:
Annual Access Control Review
Annual Board Oversight Briefings
Annual Compliance Process Review
Annual Disaster Recovery Test
Annual Incident Response Plan
Annual Key Vendors Review
Annual Review of Security Policies
Monthly application of OS patches on virtual machines
Quarterly Vulnerability Scans
Some of these procedures are pretty complicated, and it can be time-consuming or even
tricky to navigate all of them (let alone complete them with 100% success rate).
That’s why it’s useful to have this information documented in a workflow. If you use
Process Street, all information for each procedure will live inside the respective Process
Street workflow, broken down into easy to understand, actionable steps to complete each
compliance procedure.
On-demand reports for your customers
It’s tedious and unnecessary to manually answer security questionnaires whenever a
potential customer asks about the safety of your tool. When you have Drata in place, real-
time reports from a trusted third-party tool can be generated to provide evidence of
compliance.
This is also the case for your auditors. Investing in an advanced compliance security
platform allows you to publicly showcase your daily security and compliance measures
(without disclosing sensitive information).
Eliminate manual tasks & save time
You likely devote a significant portion of time to tedious tasks like:
Organizing screenshots and other evidence in shared folders
Manipulating pivot tables and spreadsheets
Manually tracking vendors, assets, and incidents
This is only if you run your compliance program manually.
Process Street and Drata pretty much make these tasks disappear. These systems coupled
together can manage:
Onboarding and training of employees

8. 8/9
All necessary evidence collection
Real-time tracking of incidents, vendors, and assets
Accurate control mapping
Simple dashboards ensure all processes are kept on track and that your business is
constantly compliant while reports can be provided when needed.
And as the saying goes, time is money!
Useful insights into business operations
Security and compliance automation software can help you make more informed
decisions. Because your business operations are monitored, you gain valuable insight into
how your company is performing. This will let you see:
How your security can be improved
If your privacy protections need updating
If your employees are playing fast and loose with your standards
How your security program is operating overall
Reduced risks & errors
Automating any process mitigates the risk of errors being made. Repetitive tasks are
taken out of your team’s to-do list and are handed over to software where work is
completed the same way each time.
Monitoring security controls also lets the system send alerts if there are any changes in
human behavior. For example, Drata and Process Street are both designed to send
notifications if an employee fails to complete a task in any required security training.
Alerts are also triggered when someone tries to access something they shouldn’t. This will
mitigate the risk of any malicious attack on your company’s data or systems. But it will
also reduce the risk of genuine mistakes (like forgetting to complete a process or tasks),
which could derail your organization’s compliance.
And the fewer manual tasks you have in your SOC 2 compliance procedures, the lower the
chance for human error.
Improved experience with your auditor
Effective compliance automation software means happier auditors and faster audits. Your
auditors no longer need to assume compliance hasn’t been continuous or rely on spot
checks.
Instead, continuous compliance can be confirmed through accurate reports and
monitoring system documentation set by Drata and Process Street. Back-and-forth
between your company and auditor is significantly reduced while the auditing process is
cheaper and faster.

9. 9/9
What is the biggest challenge you face with SOC 2 compliance? Let us know in the
comments & we’ll see if we can help make your life easier.
Oliver Peterson
Oliver Peterson is a content writer for Process Street with an interest in systems and
processes, attempting to use them as tools for taking apart problems and gaining insight
into building robust, lasting solutions.
Leave a comment
Your email address will not be published. Required fields are marked.