SOC 2 Readiness Monitoring

What is SOC 2 Type II readiness monitoring?

SOC 2 Type II is an audit standard developed by the American Institute of CPAs (AICPA) that evaluates whether a service provider's controls are operating effectively over a period of time, typically 6–12 months. The audit covers the Trust Services Criteria (TSC) — most commonly the Security criterion (CC series), with optional Availability, Confidentiality, Processing Integrity, and Privacy criteria.

ℹ️

Roughly 20–25% of SOC 2 controls relate to technical configurations that can be verified from a public URL. Shieldome automates these checks continuously. The remaining controls — access provisioning, incident response, vendor assessments, security policies — require your team's input via the manual checklist built into each scan.

Shieldome runs weekly automated checks against your service URLs and combines the results with a manual checklist that your team fills in inside the dashboard. Together they produce a readiness score and a gap list you can give directly to your auditor or security consultant.

Automated checks

CC6.1 — Logical and physical access controls

Shieldome verifies that your service enforces HTTPS, that the TLS certificate is valid and not expiring within 14 days, that the HSTS header is present with a sufficient max-age, and that there is no plain HTTP endpoint that accepts sensitive traffic. It also checks whether the HTTP response correctly redirects to HTTPS.

CC6.1 / CC7.1 — Security headers

Missing security headers are a common finding in SOC 2 audits. Shieldome checks for:

Header	Risk if missing
`Strict-Transport-Security`	Browsers may connect over HTTP on subsequent visits
`Content-Security-Policy`	No control over which scripts and resources can execute
`X-Content-Type-Options`	Browsers may MIME-sniff responses, enabling content injection
`X-Frame-Options`	Page can be embedded in an iframe for clickjacking attacks
`Referrer-Policy`	Full URL (including tokens) may be leaked to third-party sites

CC7.1 — Error and information disclosure

Shieldome probes a non-existent path on your service and checks whether the error response leaks technology details — stack traces, framework names, database engine versions, or server software. Verbose error pages give attackers a roadmap and are a common audit finding.

CC7.1 / CC8.1 — Sensitive path exposure

Shieldome probes a set of paths that should never be publicly accessible on a production service:

/.git/HEAD — exposed git repository
/.env and /.env.production — environment files containing secrets
/config.php — PHP configuration files
/phpinfo.php — PHP environment disclosure
/server-status — Apache server status
/admin and /wp-admin — admin panels exposed without authentication
CI/CD pipeline files (/Jenkinsfile, /.github/workflows/deploy.yml)

CC7.1 — Rate limiting

Shieldome sends 15 rapid requests to your service and checks whether an HTTP 429 (Too Many Requests) response is returned. Absence of rate limiting enables brute-force attacks against authentication endpoints and is a common finding in SOC 2 Type II audit prep.

CC7.2 — Change detection and WAF

Shieldome detects whether a Web Application Firewall (WAF) or CDN with security capabilities is in front of your service, based on response headers and patterns. Supported: Cloudflare, AWS WAF, Imperva, Akamai, Fastly, Sucuri, ModSecurity.

CC2.3 — Security contact (security.txt)

The presence of a /.well-known/security.txt file demonstrates that you have a responsible disclosure channel — a practice increasingly expected during SOC 2 Type II audits and one of the first things security researchers check.

Manual checklist

Each scan result includes a manual checklist covering SOC 2 controls that cannot be verified from a public URL. You answer each question inside the dashboard — answers are saved and carried forward to subsequent scans until you change them.

Criterion	Control	Question
CC1.1	Security Policy	Do you have a documented information security policy reviewed by leadership?
CC2.3	Security Contact	Do you have a public security disclosure contact (security.txt or bug bounty)?
CC3.1	Risk Assessment	Do you conduct a formal risk assessment at least annually?
CC6.2	Access Provisioning	Do you have a documented process for granting user access to systems?
CC6.3	Access Revocation	Do you have a process to revoke access within 24h when an employee leaves?
CC6.4	Physical Access	Is access to servers/offices restricted and logged (badge, biometric, or cloud-only)?
CC7.4	Incident Response	Do you have a documented and tested incident response plan?
CC9.1	Risk Mitigation	Do you have documented strategies for mitigating identified risks?
CC9.2	Vendor Assessment	Do you assess the security posture of critical third-party vendors annually?

💡

Complete the manual checklist before sharing the scan report with your auditor. Unanswered checklist items appear as gaps in the readiness score and signal to an auditor that controls have not been considered.

Plans and quotas

Plan	URLs monitored	Scan frequency	Manual checklist	Email alerts
SOC 2 Starter	3	Weekly	Yes	Yes
SOC 2 Pro	10	Weekly	Yes	Yes

Adding a URL

Open the SOC 2 Monitoring tab in the dashboard. Click Add URL, enter the base URL of your service (for example, https://app.example.com), and add an optional label. Shieldome runs the first scan immediately in the background.

Once the scan completes, the card shows:

A readiness score (0–100) combining automated checks and answered checklist items
Count of failing controls vs. total controls checked
WAF/CDN detected (if any)
Date and time of the last scan

Alert emails

You receive an email alert when:

A previously passing automated check begins to fail
A new sensitive path is found exposed
The TLS certificate is expiring within 14 days
The scan encounters an error fetching the URL

Triggering a manual scan

Click Scan now on any monitored URL card to run an immediate scan. This is useful after deploying infrastructure changes, updating security headers, or adding a WAF.

Scan history

Click View history on a URL card to see a timeline of all past scans, readiness scores, and pass/fail counts. Select any scan to review the full findings and checklist state from that point in time — useful for demonstrating improvement over time to your auditor.

Frequently asked questions

Does SOC 2 Monitoring replace a formal SOC 2 audit?
No. A SOC 2 Type II report is issued by a licensed CPA firm after an audit of your controls over an observation period. Shieldome helps you identify and remediate gaps before the audit begins, reducing the time and cost of the formal assessment. You still need a CPA firm to issue the report.

Which Trust Services Criteria does this cover?
The automated checks and manual checklist focus on the Security criterion (CC series), which is the mandatory criterion in every SOC 2 audit. Availability, Confidentiality, Processing Integrity, and Privacy criteria require additional scope definition with your auditor.

How long should I monitor before starting a SOC 2 audit?
A SOC 2 Type II report covers a specific observation period — typically 6 or 12 months. Starting continuous monitoring as early as possible gives you the longest possible evidence history and the most time to remediate any findings before the auditor's observation window begins.

Our service requires authentication — will the scanner work?
The scanner fetches URLs without a session. For SaaS products, point the scanner at your marketing site or API base URL — the checks for security headers, HTTPS, TLS, error disclosure, and rate limiting are all meaningful at the unauthenticated layer. Authenticated endpoint scanning is available in the API Security Scanner product.

Can I share the scan report with my auditor?
Yes. Scan results include timestamped findings, evidence strings, and remediation guidance. Export the full report as a PDF from the scan history view. Check with your auditor on whether they want the raw findings or the executive summary format.