SOC 2 Readiness Checklist
Work through the five Trust Services Criteria — Security (the mandatory Common Criteria), Availability, Processing Integrity, Confidentiality and Privacy. Mark each control theme Met, Partial, Not met or N/A, and get your coverage per criterion plus a prioritized list of what to fix first. Based on the AICPA Trust Services Criteria themes — a preparation aid, not an audit or legal advice. Everything runs in your browser; nothing is uploaded.
Security (Common Criteria)mandatory
The mandatory foundation of every SOC 2 report. Access controls, change management, risk assessment, vendor management, monitoring and incident response, under governance and policy. If your report covers nothing else, it covers these.
Access is formally provisioned, modified and revoked on hire, role change and termination, following least privilege — not granted ad hoc and left in place.
Multi-factor authentication is enforced for administrative, remote and production access — not merely available.
Logical access is reviewed and recertified on a defined cadence, with evidence of the review retained.
Changes to code and infrastructure are reviewed, tested, approved and tracked before reaching production.
A formal risk assessment is performed at least annually; risks are documented, rated and treated.
Third parties and vendors are assessed before onboarding and monitored over time, especially those that handle customer data.
Security events are logged, centralised and monitored, with alerting on anomalies that a human reviews and acts on.
A documented incident-response plan exists, roles are assigned, and it has been exercised — not written once and shelved.
Vulnerabilities are identified through regular scanning and remediated against defined, tracked SLAs; systems are patched.
Data is encrypted in transit and at rest for in-scope systems, with keys managed under access control and rotation.
Security policies are documented, approved by management and communicated; staff receive security-awareness training.
Physical and environmental access to facilities and infrastructure is restricted — directly, or inherited from a cloud provider under their own SOC 2.
Availabilityoptional
Optional — include it if you commit to uptime or an SLA. The system is available for operation and use as agreed: capacity, backup and restore, disaster recovery and uptime monitoring.
Capacity and performance are monitored against thresholds, and scaling or remediation happens before limits are hit.
Backups are taken, encrypted, and restoration is tested on a schedule — an untested backup is not a backup.
A disaster-recovery / business-continuity plan is documented and exercised, with defined RTO and RPO targets.
System availability and uptime are monitored with alerting, and performance against SLAs is tracked and reported.
Environmental protections (power, cooling, fire suppression) are in place or inherited from the hosting provider and reviewed.
Processing Integrityoptional
Optional — include it if complete, valid, accurate, timely and authorised processing is core to what you sell (payments, payroll, analytics). Input validation, error handling, output reconciliation and job monitoring.
Input data is validated for completeness and accuracy before it is processed, and invalid input is rejected or flagged.
Processing is monitored for errors; exceptions are logged, investigated and corrected rather than silently dropped.
Outputs are reconciled against inputs or expected results to confirm processing was complete and accurate.
Scheduled jobs and batch processing are monitored to confirm they ran and completed as intended.
System processing definitions and data flows are documented so correct processing can be verified and explained.
Confidentialityoptional
Optional — include it if you hold information customers designate confidential. Classification, encryption, access restriction, confidentiality commitments, and secure retention and disposal.
Confidential information is identified, inventoried and classified, so you know what must be protected and where it lives.
Confidential data is encrypted in transit and at rest, and access is restricted to those with a genuine need.
Confidentiality commitments (NDAs, contractual clauses) are in place with employees and relevant third parties.
Retention and secure disposal of confidential data is defined and enforced — nothing is kept or destroyed arbitrarily.
Secrets and keys protecting confidential data are managed in a vault and kept out of source code and config.
Privacyoptional
Optional — include it if you collect and process individuals’ personal information. Notice, consent and choice, collection limitation, data-subject rights, and privacy incident handling, in line with your privacy notice.
A privacy notice describes what personal data you collect, why, and how it is used — and your practice matches it.
Consent or choice is obtained where required, and individuals’ preferences are recorded and honoured.
Collection is limited to the personal data necessary for the stated purpose (data minimisation).
Retention and disposal of personal data follow a defined schedule rather than keeping everything indefinitely.
Individuals can access, correct or request deletion of their personal data, and you can fulfil those requests.
Personal data shared with third parties is governed by agreements and disclosed as your notice promises.
Privacy incidents and breaches have a defined response and notification process, aligned with the Security criterion’s IR plan.
Educational self-assessment based on the AICPA Trust Services Criteria themes, described here in plain language — it does not use or reproduce specific AICPA control reference numbers, fabricates no statistics, and makes no claim about any industry average. "Coverage" is a transparent proportion: Met counts 1, Partial 0.5 and Not met 0, averaged across the applicable (non-N/A) controls you answered, so three of six applicable controls Met gives 50% and N/A controls are excluded from the denominator entirely. This tool performs no scan and makes no network calls — it runs entirely in your browser, and your answers only leave your device in the shareable link you choose to copy. It is a preparation aid, not an audit or legal advice: a real SOC 2 report can only be issued by a licensed CPA firm that tests your controls against evidence.
What this tool is
- A free, in-browser SOC 2 readiness checklist built around the five Trust Services Criteria — Security (the mandatory Common Criteria), Availability, Processing Integrity, Confidentiality and Privacy.
- Mark each control theme Met, Partial, Not met or N/A. N/A controls are excluded from the denominator, so criteria you have not put in scope never drag your coverage down.
- You get an overall coverage percentage, a per-criterion breakdown, and a prioritized remediation list — the mandatory Security gaps surface first because every SOC 2 report must cover them.
- Export the result as Markdown or CSV, or copy a shareable link. Everything runs client-side in your browser; your answers are never uploaded.
- Based on the AICPA Trust Services Criteria themes — this is a preparation aid, not an audit or legal advice. A real SOC 2 report can only be issued by a licensed CPA firm.
What SOC 2 is
SOC 2 (System and Organization Controls 2) is an attestation report defined by the AICPA. In it, an independent, licensed CPA firm examines how a service organization protects the data it holds on behalf of its customers and issues a formal opinion. It has become the document B2B and SaaS buyers ask for during vendor security reviews — a shared, auditor-backed way to answer "can we trust you with our data?". SOC 2 is not a checklist you tick and pass; it is an examination of real controls against documented evidence, which is why this page is a readiness tool — a way to see where you stand before an auditor does.
Type I vs Type II
A Type I report assesses whether your controls are suitably designed at a single point in time — a snapshot on a given date. A Type II report tests whether those same controls operated effectively over a period, usually three to twelve months, by sampling evidence throughout the window. Type I is faster and often a first step; Type II carries more weight with customers because it proves the control kept running, not that it merely existed on one day. Both are built on the same Trust Services Criteria, so the themes in this checklist apply to either — for Type II, the extra bar is being able to show each control ran consistently across the whole review period, which usually means tickets, logs and records, not just a written policy.
The five Trust Services Criteria
- Security (Common Criteria) — mandatory. The foundation of every SOC 2 report: access controls, change management, risk assessment, vendor and third-party management, monitoring and logging, and incident response, sitting under governance and security policy. If your report covers nothing else, it covers this.
- Availability — optional. The system is available for operation and use as you have committed. Covers capacity and performance monitoring, backup and restoration, disaster recovery and business continuity, and uptime monitoring.
- Processing Integrity — optional. Processing is complete, valid, accurate, timely and authorized. Covers input validation, error handling, output reconciliation and monitoring that scheduled work actually runs and finishes.
- Confidentiality — optional. Information designated confidential is protected across its life. Covers data classification, encryption and access restriction, confidentiality commitments (NDAs and contract clauses), and secure retention and disposal.
- Privacy — optional. Personal information is collected, used, retained, disclosed and disposed of in line with your privacy notice. Covers notice, consent and choice, collection limitation, data-subject access and correction, and privacy incident handling.
Only Security is required. The other four are scoped in based on the commitments you make to customers — including fewer criteria is not cutting corners, it is matching the report to what you actually promise. In this tool you can mark a whole criterion's controls N/A to take it out of scope, and those controls are excluded from your coverage.
What an auditor looks for
An auditor does not reward intentions — they test for evidence that a control both exists and runs. Expect three things for each control theme below: a written policy approved by management, a process that implements it, and records that prove the process ran during the review period (access-review sign-offs, change tickets with approvals, scan and remediation history, backup-restore tests, incident timelines, vendor assessments). For a Type II in particular, "we have a policy" is not enough — the auditor samples across the period and expects the control to have operated each time it should have. The common failure is not a missing control but a control that works in practice yet was never documented or evidenced. That is exactly what a readiness pass like this one is for: surfacing the gaps between "we do this" and "we can prove we did this" before the audit clock starts.
Important: This checklist is based on the AICPA Trust Services Criteria themes, described here in plain language — it does not use or reproduce specific AICPA control reference numbers, and it is not an audit or legal advice. A real SOC 2 report can only be issued by a licensed CPA firm that tests your controls against evidence. Use this to prepare and prioritize, then engage a qualified auditor.
Frequently asked questions
What is a SOC 2 report?
SOC 2 (System and Organization Controls 2) is an attestation report, defined by the AICPA, in which an independent, licensed CPA firm examines how a service organization protects customer data. The examination is structured around the Trust Services Criteria: a mandatory Security criterion (often called the Common Criteria) plus four optional criteria — Availability, Processing Integrity, Confidentiality and Privacy — that you include based on the commitments you make to customers. The report describes your controls and the auditor’s opinion on them. It is the de facto trust document SaaS and B2B vendors are asked for during security reviews. This tool is a readiness self-assessment that helps you see where you stand before you engage an auditor; it is not itself a SOC 2 report.
What is the difference between SOC 2 Type I and Type II?
A Type I report evaluates whether your controls are suitably designed at a single point in time — a snapshot of your control environment on a given date. A Type II report goes further: it tests whether those controls actually operated effectively over a review period, typically three to twelve months, by sampling evidence throughout that window. Type I is faster and cheaper and is often used as a first step; Type II carries more weight with customers because it demonstrates sustained operation, not just good intentions on one day. Both use the same Trust Services Criteria, so the readiness themes in this checklist apply to either — Type II simply means you must be able to show the control ran consistently across the whole period.
What are the five Trust Services Criteria?
Security is the only mandatory criterion and underpins every SOC 2 report; it covers the common controls — access management, change management, risk assessment, vendor management, monitoring and logging, and incident response. The other four are optional and included only if they are relevant to your service commitments: Availability (the system is available for operation as agreed), Processing Integrity (processing is complete, valid, accurate, timely and authorized), Confidentiality (information designated confidential is protected), and Privacy (personal information is collected, used, retained, disclosed and disposed of in line with your privacy notice). Choosing fewer criteria is not cutting corners — it is scoping the report to what you actually promise customers.
Which Trust Services Criteria do I actually need?
Always Security — no SOC 2 report can omit it. Beyond that, scope to your promises: include Availability if you commit to uptime or an SLA, Confidentiality if you handle customer data classified as confidential, Processing Integrity if correct and complete processing is core to what you sell (payments, payroll, analytics pipelines), and Privacy if you collect and process individuals’ personal data and make privacy commitments. Many SaaS companies start with Security plus Availability and Confidentiality. In this tool you can mark an entire criterion’s controls N/A to take it out of scope, and those controls are excluded from your coverage so the number reflects only what you have chosen to be assessed against.
Does scoring high on this checklist mean I will pass a SOC 2 audit?
No. This is a self-assessment that reflects your own honest answers against control themes drawn from the AICPA Trust Services Criteria; it performs no verification, sees no evidence, and issues no opinion. A SOC 2 report can only be produced by an independent, licensed CPA firm that tests your controls against documented evidence. Use a high coverage score as a sign you are likely ready to engage an auditor with fewer surprises, and use the prioritized remediation list to close gaps first. Treat a low score as a to-do list, not a verdict. Nothing here is audit assurance or legal advice.