System description
Road to audit-readiness
The System Description is the backbone of your SOC 2 report. It tells your auditor (and anyone reading the report) exactly what’s being audited, how your system works, and how or where the controls are applied.
The system description is not just a high-level summary. It’s a detailed walkthrough of your service, including:
What’s in scope: The specific product or service covered in the audit.
Supporting components: Infrastructure (e.g. AWS), software (e.g. GitHub, Jira), people, data, and processes involved in delivering that service.
How data flows: From user input to processing, storage, and output.
Third-party dependencies: Any subservice organizations (e.g. cloud providers) that play a critical role in system operations.
Customer-side responsibilities: These are controls your customers need to have to maintain shared security, known as Complementary User Entity Controls (CUECs).
Internal control structure: You’ll also explain how your company approaches internal control, based on five components:
Control environment
Risk assessment
Information and communication
Monitoring activities
Control activities
The goal is Transparency. The system description gives your auditor the context they need to evaluate your controls, and helps customers understand how your service stays secure.
The system description is not just a high-level summary. It’s a detailed walkthrough of your service, including:
What’s in scope: The specific product or service covered in the audit.
Supporting components: Infrastructure (e.g. AWS), software (e.g. GitHub, Jira), people, data, and processes involved in delivering that service.
How data flows: From user input to processing, storage, and output.
Third-party dependencies: Any subservice organizations (e.g. cloud providers) that play a critical role in system operations.
Customer-side responsibilities: These are controls your customers need to have to maintain shared security, known as Complementary User Entity Controls (CUECs).
Internal control structure: You’ll also explain how your company approaches internal control, based on five components:
Control environment
Risk assessment
Information and communication
Monitoring activities
Control activities
The goal is Transparency. The system description gives your auditor the context they need to evaluate your controls, and helps customers understand how your service stays secure.
SOC Frameworks Overview
SOC 2 Basics
SOC 2 Compliance Process
SOC 2 Compliance Process
Sprinto: Your ally for all things compliance, risk, governance
