Lead Manager
Lead SOC 2 Manager
2026 edition
Self-paced PECB training delivered via myPECB.
Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.
Develop the expertise to scope, prepare, and report on SOC 2 Type I and Type II engagements under the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Covers control mapping, evidence gathering, and exception reporting. Concludes with the official PECB certifying exam.
- Typical study effort
- 30–40 hours
- CPD credits
- 31
- Course languages
- English
Who it is for
- Internal audit and compliance teams running SOC 2 programs
- Cloud security teams supporting SOC 2 audits
- Consultants advising on SOC 2 readiness for SaaS clients
What you will learn
- Scope and plan a SOC 2 Type I or Type II engagement under the AICPA Trust Services Criteria.
- Map controls to the five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, Privacy.
- Gather and evaluate evidence to AICPA SSAE 18 / SOC 2 standards.
- Identify and document exceptions, deviations, and management responses.
- Position SOC 2 alongside ISO 27001 to avoid duplicate audit work.
Course content
Module 1 — SOC 2 foundations
- AICPA, SSAE 18, and the SOC reporting family
- Trust Services Criteria explained
- Type I vs. Type II engagements
- Common SOC 2 use cases in SaaS
Module 2 — Planning a SOC 2 engagement
- Defining system boundary and scope
- Selecting applicable Trust Services Criteria
- Period of coverage decisions
- Stakeholder mapping and timelines
Module 3 — Control mapping and design
- Mapping internal controls to TSCs
- Common control libraries (NIST 800-53, ISO 27001)
- Design effectiveness vs. operating effectiveness
- Avoiding gaps and overlaps
Module 4 — Evidence gathering and testing
- Sampling strategies for SOC 2
- Inquiry, observation, inspection, reperformance
- Working paper standards
- Population definition and completeness
Module 5 — Reporting and exceptions
- Structure of a SOC 2 report
- Documenting exceptions and management responses
- Modified opinions
- Communicating findings to leadership
Module 6 — Integrating SOC 2 with ISO 27001 and exam prep
- Combined SOC 2 + ISO 27001 programs
- Avoiding duplicate audit fatigue
- Continuous controls monitoring
- Exam strategy and case studies
Prerequisites
- Working knowledge of information security or audit fundamentals.
- Prior ISO 27001 or audit experience is helpful but not required.
The exam
- Format
- Open book. Multiple choice, three options per question, mixing stand-alone and scenario-based sets
- Duration
- 3 hours
- Questions
- 80 questions across 5 competency domains — planning and implementation are 47 of the 80
- Pass mark
- 70%
What is included
Course materials
- PECB Lead SOC 2 Manager slide deck (digital)
- 12 months access via myPECB
- Module quizzes, practice scenarios, and exam-style cases
- Trust Services Criteria reference and worked control examples
Exam package
- Official PECB Lead SOC 2 Manager exam voucher
- Three-hour open-book exam, remotely proctored
- Two exam attempts (initial + one free resit)
- PECB Lead SOC 2 Manager credential on pass