Notifications
Clear all
Topic starter
26/08/2026 11:50 am
TL;DR: SOC 2 has become the default starting point for many B2B teams, with roughly 70% of Drata customers already holding the framework and integration footprint emerging as the clearest maturity signal, according to Drata’s SOC 2 By the Numbers report. The pattern shows that compliance now runs as an operating system for access, evidence, and vendor governance, not a one-off audit project.
NHIMG editorial — based on content published by Drata: SOC 2 By the Numbers
By the numbers:
- 70% of Drata customers have SOC 2., e SOC 2.
Questions worth separating out
Q: How should teams build SOC 2 readiness into day-to-day operations?
A: Teams should treat SOC 2 as a continuous control system, not a late-stage audit task.
Q: Why does SOC 2 readiness depend so much on identity and access control?
A: SOC 2 relies on knowing who or what can access systems, how that access is approved, and whether it is revoked when no longer needed.
Q: What breaks when compliance evidence is collected manually?
A: Manual evidence collection breaks when the organisation cannot keep pace with configuration changes, entitlement changes, and vendor updates.
Practitioner guidance
- Standardise your control evidence pipeline Connect source control, cloud, identity, ticketing, and HR systems into a single evidence flow so reviews, approvals, and changes are captured where they happen.
- Tie access governance to audit-ready records Make sure access reviews, ownership changes, and offboarding events leave durable records that can be reused for SOC 2 and adjacent frameworks.
- Track control drift in production systems Prioritise monitoring for configuration changes, failed tests, and control exceptions in the environments that change most often.
What's in the full report
Drata's full report covers the operational detail this post intentionally leaves for the source:
- Segment-by-segment readiness patterns across company size, region, and industry.
- The integration mix behind the strongest SOC 2 programmes, including the systems most commonly connected.
- The control areas where teams fail most often, with more context on vulnerability remediation and production configuration hygiene.
- The way first-report teams expand into adjacent frameworks such as ISO 27001, HIPAA, and PCI DSS.
👉 Read Drata's SOC 2 By the Numbers report →
SOC 2 maturity and readiness gaps: what practitioners need to know?
Explore further
26/08/2026 11:51 am
SOC 2 has become an operating model, not a report. The report’s strongest signal is not the adoption rate itself, but the way compliance now depends on continuous evidence, integrated systems, and repeatable control ownership. That shifts SOC 2 from a finite project to a sustained governance layer. For identity teams, that means access reviews, service account ownership, and logging cannot sit outside the compliance system.
A question worth separating out:
Q: How should security teams govern non-human identities for SOC 2 compliance?
A: Teams should inventory every machine identity, assign an owner, restrict permissions to the minimum required, rotate secrets regularly, and log access in a way that supports audit evidence. SOC 2 is easier to defend when non-human identities are treated as governed assets rather than background infrastructure.
👉 Read our full editorial: SOC 2 is now the baseline for scaling B2B security programmes
