I am an IT security professional, currently working as an IT Auditor and am very familiar with the SOC 2 attestations.To answer your question, it helps to first give a little of background into the SOC 2 program.
Th SOC 2 certification is the brainchild of the AICPA and it is based on Trust Service Principles. Each Trust Principle has a defined set of control criteria that outlines what characteristics the system as your management defines must meet. As to the specific controls used to meet each control criteria, that is a decision of your company's senior management.
Are there any specific steps one must follow to achieve SOC 2 compliance?
This question is ultimately misguided. The SOC 2 is concerned around the controls that your management has defined governing the services
it provides to a client. As such, rather than asking what checklist I can use to ensure I pass, think about which of the Trust Principles are important to the customers of your company. Most likely they will be reviewing the audit results before deciding whether or not to do business with your firm. If controls attested to by the service auditor are of no value to the end customer, having a SOC 2 certification means nothing for that particular customer
At a high level, the service auditor will be looking to see that the the controls contained in the description given by the senior management of your company are suitably designed and operating effectively to meet the control objectives for each of the Trust Principles. Representative questions the service auditor may ask are listed below:
Are procedures and policies necessary to meet the Trust Principles (as applicable based on service provided) communicated to relevant users?
Is the system as defined protected against unauthorized access (Security Principle)
Is confidential data as defined with the customer protected as agreed upon? (Confidentiality principle)
Ultimately, you are much better served, by focusing on customer needs rather than a generic "check the box" approach.