Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Supporting SOC 2 Audits Using JupiterOne - AskJ1 Community
<main> <article class="userContent"> <p>There are several tasks involved in ensuring your SOC 2 compliance is current and complete.</p> <ol><li>Configure J1 integrations.</li> <li>Review your compliance policies and procedures.</li> <li>Import the SOC 2 compliance framework.</li> <li>Link compliance controls.</li> <li>Review linked evidence.</li> <li>Add additional queries.</li> </ol><h3 data-id="configure-j1-integrations">Configure J1 Integrations</h3> <p>The first step is to ensure all relevant, managed integrations are properly configured and working. For SOC 2, you must determine which integrations are necessary based on your in-scope environment, such as the relevant system components, infrastructure, tooling, and so on that provide your service or product to your customers.</p> <p>After you configure them, the integrations automatically start collecting data about your environment at a recurring cadence.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/JIHOJJJ9JALO/integrations-start.png" alt="integrations" class="embedImage-img importedEmbed-img"></img></p> <p>Go to <a rel="nofollow" href="https://apps.us.jupiterone.io/integrations">J1 integrations</a> and follow the instructions in the <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/825-configure-managed-integrations">J1 docs</a>.</p> <h3 data-id="review-the-policies-and-procedures">Review the Policies and Procedures</h3> <p>Go to <a rel="nofollow" href="https://apps.us.jupiterone.io/policies/program">J1 Policies</a> and review all of the templated, default policies and procedures. Ensure the policies accurately represent the principles and processes of your organization. You can edit and modify the default policies, customizing them and/or adding your own policies and procedures documentation, where relevant. Remove or delete documents that are not relevant to your organization.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/Z7W6RMAS3MBC/policies-overview.png" alt="policies" class="embedImage-img importedEmbed-img"></img></p> <p>Reviewing and tailoring instructions are provided for the default policies and procedures in the UI. If you the policies were not configured during the setup of your J1 account, you should go into J1 Policies and use the policy builder to prefill the templated policies and procedures.</p> <p>Additional support documentation is available:</p> <ul><li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/815-managing-policies-and-procedures-on-jupiterone">Managing policies and procedures</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/817-using-the-policy-builder-cli">Using the policy builder CLI</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/815-managing-policies-and-procedures-on-jupiterone">Policies and procedures structure</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1156-linking-compliance-policies">Compliance policies mapping</a></li> </ul><h3 data-id="import-the-compliance-framework">Import the Compliance Framework</h3> <p>Import the SOC 2 Security compliance framework in <a rel="nofollow" href="https://apps.us.jupiterone.io/compliance">J1 Compliance</a>.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/8MR3Z82HI5US/import-framework.gif" alt="import-framework" class="embedImage-img importedEmbed-img"></img></p> <p>Read more about <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1154-adding-compliance-frameworks">Importing compliance standards or security questionnaires</a>.</p> <h3 data-id="managing-controls">Managing Controls</h3> <p>Within the default SOC 2 framework, templated controls are mapped to the common criteria required to meet the Security trust service category.</p> <p>In <a rel="nofollow" href="https://apps.us.jupiterone.io/compliance">J1 Compliance</a>, you can add controls, remove controls, and/or update the control link.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/27GXCDJWJEQ7/edit-control-mapping.gif" alt="control-mapping" class="embedImage-img importedEmbed-img"></img></p> <p>Read more about the <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1153-linking-controls-to-compliance-requirements">J1 Controls library</a>.</p> <h2 data-id="review-control-evidence">Review Control Evidence</h2> <p>For each control, you must provide corresponding evidence that demonstrate reasonable assurance the control has been designed and implemented (SOC 2 Type I) and operating effectively over the review period (SOC 2 Type II).</p> <p>By default, for the standard controls within the SOC 2 framework in J1 Compliance, more than half the controls have partial to full evidence already mapped, by way of JupiterOne query language (J1QL) managed queries.</p> <ol><li>For each control, review the default mapped evidence, if applicable.</li> <li>If the evidence is satisfactory, go to the next control.</li> <li>If the evidence is unsatisfactory because it is incorrect or incomplete, edit the mapped queries so the returned output is as expected.</li> </ol><p><img src="https://us.v-cdn.net/6035534/uploads/4YYNSPH0XYIE/editing-queries.gif" alt="edit-query" class="embedImage-img importedEmbed-img"></img></p> <p>Additional support documentation:</p> <ul><li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/844-jupiterone-query-language-tutorial">J1QL query tutorial</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/836-get-started-with-search">Search quickstart</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/980-introduction-to-jupiterone-query-language-j1ql">J1QL language specs</a></li> </ul><h3 data-id="add-additional-queries">Add Additional Queries</h3> <p>You can add more queries to ascertain SOC 2 compliance.</p> <p>Read more:</p> <ul><li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/844-jupiterone-query-language-tutorial">J1QL query tutorial</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/836-get-started-with-search">Search quickstart</a></li> <li><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/980-introduction-to-jupiterone-query-language-j1ql">J1QL language specs</a></li> </ul><p>You can also map a prewritten, templated query from the hundreds in the J1 library.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/T1N4MJTX6G8O/additional-queries.gif" alt="additional-query" class="embedImage-img importedEmbed-img"></img></p> <p>Additional support documentation:</p> <ul><li><p><a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1037-common-questions-and-corresponding-j1ql-queries">Common questions + queries</a></p></li> <li><p><a rel="nofollow" href="https://ask.us.jupiterone.io/filter?tagFilter=all">All questions + queries</a></p></li> </ul><h3 data-id="adding-additional-evidence">Adding Additional Evidence</h3> <p>You can also link additional evidence such as hyperlinks, uploaded files (spreadsheets, compressed files), notes, and attestations.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/ICT6CQD3NLST/compliance-add-evidence.png" alt="alternative-evidence" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="n-a"> </h2> <h3 data-id="reporting-on-monitoring-soc-2-progress-readiness-workflows">Reporting on/Monitoring SOC 2 Progress/Readiness + Workflows</h3> <p>For visibility, the default SOC 2 compliance framework landing page has the status of both evidence collection and a gap analysis to quickly identify which controls require your attention.</p> <p>Clicking any of the four progress bars provides a more detailed summary, with any of the reported details, clickable to quickly filter all of the controls with the same status.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/00T9VH0Y02AH/status-gap.gif" alt="gap-status" class="embedImage-img importedEmbed-img"></img></p> <h3 data-id="internal-auditor-workflows">Internal Auditor Workflows</h3> <p>J1 Compliance enables a workflow functionality that allows your team to internally track workflow status, as well as the ability to invite your external auditors to use J1 to conduct the assessment with the same workflow functionality.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/G39I7B827JW0/workflow.gif" alt="workflow" class="embedImage-img importedEmbed-img"></img></p> <p><a rel="nofollow" href="https://try.jupiterone.com/blog/video-workflows-within-the-j1-compliance-app">Watch this video</a> for more information about compliance workflows for collaboration.</p> <h4 data-id="managing-access">Managing Access</h4> <p>You can invite internal team members or external auditors, into your J1 environment.</p> <ul><li>Access is managed by role-based access control (RBAC) groups.</li> <li>Users are invited via email address.</li> <li>Granular access permissions are available.</li> </ul><p>Read more in <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/973-invite-users-to-your-j1-account-or-organization">Invite your team members</a>.</p> <p><img src="../assets/access.gif" alt="access" class="embedImage-img importedEmbed-img"></img></p> <h4 data-id="recurring-review-configuration">Recurring Review Configuration</h4> <p>For continuous compliance monitoring, you can set the recurring review configuration workflow to assign specific team members to receive notifications to review or maintain individual controls, groups of controls, or entire frameworks.</p> <p>By default, controls with queries/questions mapped for evidence are re-evaluated daily.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/TICCX57R07M5/review-config.gif" alt="review-config" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="exporting-compliance-artifacts">Exporting Compliance Artifacts</h2> <p>J1 provides the capability to export compliance artifacts such as control evidence, policies and procedures, reports, and others.</p> <p>You can export a summary report (PDF) or download a zip file of all the evidence for the whole framework.</p> <p>In addition, you can download evidence for a single control.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/M602MZ5NF6IB/exporting-artifacts.gif" alt="export-artifacts" class="embedImage-img importedEmbed-img"></img></p> </article> </main>
.png)