SOC 2 Type 2 population and sampling guide

The main difference when moving from a Type 1 audit to a Type 2 audit is the inclusion of sample testing. Since the Type 2 audit covers a period of time known as the monitoring period (also referred to as an audit period review period, or observation window), auditors test the operationalization of controls throughout the period by performing sample testing.

Sample testing is when auditors select certain instances of a control performing for which they require specific evidence to be provided. For example, auditors review an organization's new hire list then select specific new hires for which they will request their specific background checks.

Population requests

Population evidence items are lists, not a collection of all samples. For example, the change request population is a list of all changes that occurred during the monitoring period, not screenshots of the actual tickets. Please wait to provide samples until they are requested; the auditor will communicate their sample requests once the audit starts using the DRL.

Population listings must include data from the entire monitoring period in order to be considered valid. For example, if your monitoring period is 01/01/23 - 12/31/23, you would need to wait until 01/01/24 to generate and upload the listings, and the listings must include the entire period.

Common population requests include:

• Breach List

• Contractor List

• Customer List

• Data Disposal List

• Emergency Change List

• Employee List

• Infrastructure Change List

• Public Incident Report List

• Security Incident List

• Software/Application Change List

• Termination List

• Vendor List

Parameters

Parameter evidence items communicate to auditors how the population listings were generated. For example, if your list of new hires is uploaded as a .csv export from an HR tool, you should also upload a screenshot that shows the filters used in order to export the list from the HR tool.

In some cases, a separate attachment with the parameter data is not necessary as that information is inherent within the population itself. For instance, if the evidence you upload for the Employee List is a screenshot directly from your HRIS system, and the filters used to generate the listing are included in the screenshot, there is no need to provide a separate screenshot.

Locating populations within the Strike Graph platform

By filtering your Evidence Repository for Status: Active and Type: Population, your organization will be able to easily find all populations that you are responsible for providing. Your CSM will activate population evidence items that directly relate to your control set. For example, if your organization does not employ contractors, then the Contractor List population will not be activated.

Sampling methodology

Auditors review the populations provided and request various samples based on several combined factors. Samples are the specific instances of a control occurring during the review period that the auditor wants to see, such as a specific access revocation ticket for a terminated employee, or a specific change approval ticket for a system change.

The number of samples selected depends upon the below factors:

• Frequency:

  • This may be period (e.g. annual, quarterly, weekly, etc.) or event (i.e., number of days) driven.

  • Typically, more frequently occurring controls will result in a higher number of samples requested.

• Risk level: More samples may be required for higher risk controls.

  • To determine the risk level of a control, please refer to the risks associated with the controls:

• Whether the control is manual or automated:

  • Automated controls typically only require one sample, regardless of frequency or risk.

  • Manual controls may require multiple samples, determined by frequency and/or risk.

• Examples:

  • Evidence that is monthly and supports a moderate risk control will typically require two samples, while monthly evidence that supports a high risk control typically requires three samples. If the control is automated, only one sample will be required.

  • Evidence that is on a cadence to repeat 25 times per year will typically require five samples for a high risk control (three for a moderate risk control); evidence that is on a cadence to repeat weekly typically requires 10 samples for a high risk control (eight for a moderate risk control). If the control is automated, only one sample will be required.

  • A large population (more than 365 samples available) may require 60 samples for a high risk control or 45 for a moderate risk control; if the control is automated, only one sample will be required.