HR
- An HR system as the single record of who works for you, with hire and departure dates. See the HR system setup checklist.
- Onboarding and offboarding checklists that are followed every time.
- Security awareness training with completion records.
- Policy acceptance recorded for every employee.
- Background checks, if your policy calls for them.
IT
- An identity provider with single sign-on and multi-factor authentication turned on for everyone.
- Device management so every laptop is encrypted, locked and kept up to date.
- A password manager for shared credentials. See how to roll one out.
- Backups that are tested.
- Regular access reviews of key systems. See how to run a user access review.
Web and engineering
- A code repository where every change is reviewed before release.
- Cloud hosting with logging and monitoring turned on.
- Vulnerability scanning with a record of fixes.
- A ticketing system that ties changes and incidents to a record.
- For your website: updates applied on a schedule, security monitoring and backups.
Finance
- An accounting system with individual logins and role-based access.
- Approval steps for payments, so one person cannot both create and approve.
- Contract and invoice records for every vendor.
SOC 2 is not a financial audit, but access control and vendor records in finance systems are in scope when they touch customer data or company security.
Operations
- A compliance platform to monitor controls and hold evidence.
- A vendor list with owners, renewal dates and security reviews. See building a vendor list.
- A home for documentation, where policies and procedures are kept current. See how to write an SOP.
- An incident log and a tested response plan.
- A risk assessment, reviewed at least once a year.
RevOps
- A CRM with role-based access, so people see only the customer data they need.
- Contract storage and e-signature with controlled access.
- A support desk that records customer requests and how they were handled.
- A clear handoff to billing. See bookings to billings.
What ties it together
Each of these systems needs an owner, individual logins and a record of who has access. Most also need to be connected to your identity provider and compliance platform. The tools matter less than whether they are set up properly and kept that way.
We select, set up and manage these systems across departments. See systems selection and setup and our suggested tools.