{"product_id":"soc-2-risk-assessment-vendor-management-kit","title":"SOC 2 Risk Assessment \u0026 Vendor Management Kit","description":"\u003cp\u003e\u003cstrong\u003eA credible SOC 2 risk assessment and vendor management program without buying a GRC platform.\u003c\/strong\u003e These are two areas where first-time SOC 2 companies often have thin evidence.\u003c\/p\u003e\u003ch2\u003eWhat you get\u003c\/h2\u003e\u003col\u003e\n\u003cli\u003e\n\u003cstrong\u003eRisk Assessment Procedure\u003c\/strong\u003e (Word, 6 pages): a step-by-step method for the annual and change-driven risk assessment, including fraud risk (CC3.1 to CC3.4), with a fictional worked example.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRisk Register\u003c\/strong\u003e (Excel): a 5 x 5 register with 47 pre-written SaaS risks written as cause, event and consequence, inherent and residual scoring, an appetite flag, heat maps and a dashboard.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Management Procedure\u003c\/strong\u003e (Word, 6 pages): intake, tiering, due diligence by tier, how to review a SOC 2 report and its complementary user entity controls (CUECs), contract terms, monitoring and offboarding (CC9.2).\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Inventory and Risk Tiering\u003c\/strong\u003e (Excel): automatic tiering from six questions, review due dates, a 14-step SOC report review checklist, review log, CUEC mapping and dashboard.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Security Questionnaire\u003c\/strong\u003e (Excel): 62 questions in 14 sections with answer dropdowns, weights, critical flags and automatic scoring.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eStart Here guide\u003c\/strong\u003e (PDF): the order of work, what good looks like and common mistakes.\u003c\/li\u003e\n\u003c\/ol\u003e\u003cp\u003eAlso included in the \u003ca href=\"\/products\/soc-2-starter-bundle\"\u003eSOC 2 Starter Bundle\u003c\/a\u003e and the \u003ca href=\"\/products\/soc-2-compliance-toolkit\"\u003eSOC 2 Compliance Toolkit\u003c\/a\u003e.\u003c\/p\u003e\u003ch2\u003eHow to use it\u003c\/h2\u003e\u003col\u003e\n\u003cli\u003eRead the procedure and confirm scales and appetite with the CEO.\u003c\/li\u003e\n\u003cli\u003eAdapt the example risks, then run a 60 to 90 minute workshop with your leads, including a fraud discussion.\u003c\/li\u003e\n\u003cli\u003eAgree treatments, get CEO approval and save a dated copy as evidence.\u003c\/li\u003e\n\u003cli\u003eList every vendor (check your identity provider app list, expense reports and cloud marketplace) and let the workbook tier them.\u003c\/li\u003e\n\u003cli\u003eReview SOC reports from Critical and High vendors, map the CUECs, and send the questionnaire to vendors without a report.\u003c\/li\u003e\n\u003c\/ol\u003e\u003ch2\u003eWho it is for\u003c\/h2\u003e\u003cp\u003eThe person responsible for SOC 2 readiness at a SaaS company, and teams whose platform's built-in risk register feels generic. Auditors want to see real risks, fraud discussed, risk reviewed when things change, and vendor SOC reports actually read.\u003c\/p\u003e\u003ch2\u003eGood to know\u003c\/h2\u003e\u003cul\u003e\n\u003cli\u003eInstant download. Editable Word (.docx) and Excel (.xlsx), plus a PDF guide. Works in Excel 2016 or later, Microsoft 365 and LibreOffice; no macros.\u003c\/li\u003e\n\u003cli\u003eLicensed for use within one organization.\u003c\/li\u003e\n\u003cli\u003eCriteria are referenced by number and summarized in our own words; the AICPA criteria are free to download from the AICPA.\u003c\/li\u003e\n\u003cli\u003eSOC 2 is an attestation report by a licensed CPA firm, not a certification. These templates help you prepare; they do not guarantee an unqualified SOC 2 opinion.\u003c\/li\u003e\n\u003cli\u003e5-day fit guarantee: if it does not fit your system, contact us within 5 days of purchase.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"ISO Cloud Consulting","offers":[{"title":"Default Title","offer_id":67603741343938,"sku":"ICC-SOC2-RISK-VENDOR","price":49.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0709\/8361\/4658\/files\/soc-2-risk-assessment-vendor-management-kit.png?v=1790686150","url":"https:\/\/isocloudconsulting.com\/products\/soc-2-risk-assessment-vendor-management-kit","provider":"ISO Cloud Consulting","version":"1.0","type":"link"}