We acquired a roughly 30-person company about nine months ago, but the technical integration is still incomplete. Our SOC 2 audit is scheduled in about four weeks, and a control-by-control review has uncovered gaps across nearly every area.
Their team still uses a separate shared password-manager vault and can access production through old credentials. Our CI/CD systems also remain split: our pipelines retrieve secrets at runtime, while theirs relies on repository secrets and some plaintext environment files. More than half of their employees still use endpoints that are not covered by our EDR platform. Offboarding is inconsistent too—I recently found that an employee who left three months ago still had an active account, and we do not know which other systems they can access. Neither organization has completed an access review since the acquisition.
We clearly cannot fix everything in four weeks. What should we prioritize immediately, and should we consider narrowing the audit scope or handling the acquired environment separately?
5 Answers
First, assign one person full ownership of the integration and audit remediation. Do not make this a vague 20% side project; remove other responsibilities so they can drive owners, deadlines, evidence, and escalation. Auditors are more likely to accept known gaps when you can clearly explain who is fixing each one and by when than when nobody owns the work.
Start with the live blast-radius issues, not CI/CD consolidation. Immediately disable former employees, review access to production, cloud accounts, repositories, and collaboration tools, and rotate credentials that may have been exposed through the old vault or plaintext files. Then move secrets into the approved system and revoke the old versions—rewriting a file or repository history does not make an exposed credential safe. Document every exception and assign a remediation date.
Do not try to pretend the gaps do not exist. Build a remediation plan now with the risk, compensating control, owner, target date, and evidence for each unfinished item. Secrets exposure, production access, former employees, and unmanaged endpoints should come before normalizing the two build stacks. A temporary exception with real monitoring and a funded plan is much easier to defend than an undocumented problem discovered during fieldwork.
The active account belonging to a former employee is the clearest urgent finding. Run an emergency leaver review across every system, compare your HR records with identity-provider and application access, revoke accounts and tokens, and rotate anything they could have reached. Put a repeatable offboarding checklist and periodic access review in place before the audit. For laptops that cannot yet be enrolled in endpoint monitoring, use a short-lived, documented exception with a firm enrollment deadline.
Talk to the auditor this week about scope. The acquired environment may be excluded or carved out if it is not part of the system being audited and has not been fully integrated. A narrower system description, or a separate assessment later once the controls have operated long enough, may be more realistic than forcing immature parallel systems into the current audit. Make sure any acquired personnel with access to production or other in-scope systems are still covered by the relevant access, endpoint, and credential controls.
I had not considered carving the acquired environment out. Trying to pull everything into compliance in four weeks was starting to seem impossible, so a narrower scope and a later assessment may be the practical option. I will raise it with the auditor immediately.