SOC 2 Gap Analysis Automation for Internal Systems

The GRC platform already crawled Okta, AWS, and GitHub. The audit still trips on the billing admin, the support override console, and the homegrown data pipeline. SOC 2 gap analysis automation, as we build it, is a scan of those custom and internal systems — the ones the connector catalog cannot see — that outputs a ranked remediation backlog before fieldwork starts.

We do not pitch a replacement for the platform you already pay for. That layer covers the easy 70 percent. We build the other 30: probes, evidence adapters, and a backlog an engineer can execute. We also do not claim a SOC 2 certification. We build the pipeline that supports the path.

The AICPA SOC 2 Trust Services Criteria still apply to a tool you wrote last year. Auditors already know to ask. See SOC 2 evidence for internal tools.

What SOC 2 Gap Analysis Automation Has to Inventory

Platforms integrate with vendors that published an API and a partnership. They do not know:

• Your internal admin Next.js app with a local user table
• The Python job that can export customer data to S3
• The support console that impersonates users
• The Terraform state bucket's human break-glass
• The staging environment that shares production credentials "temporarily"

A gap analysis that only restates the GRC dashboard is a status meeting. Automation here means we have a system list from engineering (repos, app registries, SSO app tiles, DNS, AWS accounts) and we probe each one for the controls fieldwork will test: unique auth, access logs, change path, secret shape, backup/restore story.

The Probe Set We Run

Each target gets a thin adapter. Not a full audit. A machine-readable score plus a missing-artifact list.

def probe_internal_app(app):
    return {
        "system": app.name,
        "auth": app.has_idp_sso(),          # local passwords are a finding
        "access_log": app.has_auth_log(days=90),
        "admin_review": app.has_role_export(),
        "change_mgmt": app.deploys_via_oidc_ci(),
        "secrets": app.standing_keys(),     # AKIA, client secrets, shared admin
        "data_class": app.touches_customer_data(),
        "owner": app.owner,
    }

Scoring is boring on purpose. A system that stores customer data and has shared local admins outranks a marketing microsite with the same local admin. Rank is severity × likelihood_in_sample × effort. Effort last. The auditor will not skip the support console because the fix is annoying.

This is complementary to SOC 2 Type 1 vs Type 2 evidence. A Type 1 snapshot of "we intend to log" does not help if the probe shows 12 days of logs. A Type 2 window needs the probe to pass across the window — which is why freshness tracking is a sibling job, not this one.

Ranked Backlog, Not a 80-Page Gap Report

The deliverable we ship is a backlog an engineering manager can put in the tracker:

Each row has an owner already in the org. We do not accept "Security" as the owner of a product admin tool. We will pair on the fix. We will not take the pager for the app.

The narrative report exists for the vCISO or compliance manager who has to talk to the audit firm. The tracker is what closes gaps. If you only wanted a PDF, you did not need this engagement.

How This Differs From a Readiness Spreadsheet

Readiness workshops produce opinions. Probes produce facts: this repo still has AWS_ACCESS_KEY_ID in GitLab variables; this app's /admin/users has no last-login column; this bucket is in the production account and is writable by a developer role. We attach the query, not a traffic-light emoji.

We reuse work already done on the standard stack. If AWS CloudTrail and Okta are already green in the GRC tool, we do not re-score them unless the probe finds a shadow account. Time goes to internal tools and to the evidence mapping you will need if you also run ISO — see SOC 2 ISO 27001 control mapping.

What We Will Not Pretend

• We are not the auditor. Passing our probes is not a SOC 2 report.
• We will not "scan the world" without a system inventory. Discovery helps; a named list from engineering is required.
• We will not dump CUI, customer exports, or production payloads into the backlog ticket. Findings are metadata.
• We will not recommend ripping out the GRC platform. The backlog is what to build behind it.

Alaska-based or not, the constraint is the same: mid-market teams have more custom surface than connector catalogs assume. The diagnostic is how we see that surface in a week instead of during week two of fieldwork.

SOC 2 gap analysis automation is security automation plus enough full-stack development to attach adapters to apps that never had an evidence API.

Ask us what your GRC platform is not covering: rutagon.com/contact · 907-841-8407 · contact@rutagon.com.

Frequently Asked Questions

Does this replace a readiness assessment from our audit firm?

No. The firm still decides what they will test. We give you a technical backlog so fewer of those tests fail on custom systems they were going to pick anyway.

Can the GRC platform do this if we turn on more integrations?

It can do more vendor systems. It cannot see an internal app until someone writes an adapter. That adapter is the engagement.

How do you rank gaps when everything looks High?

Customer-data systems with standing credentials and no logs go first. Cosmetic policy gaps on a brochure site go last. We will argue with a traffic-light template that marks every missing screenshot Critical.

What do you need from us to run the probes?

A system list, read access to IdP app tiles and CI variables, and an owner per app. We do not need production data. We do need to know which apps can touch it.

How does this connect to evidence freshness later?

Probes tell you what is missing. Freshness tracking tells you the artifacts you do have are still in date when the Type 2 sample is pulled. Different jobs, same store.