SOC 2 readiness checklist

What a service auditor needs to see before a SOC 2 examination. Structured around the trust services criteria and the operating evidence a Type II report depends on.

Read this first. Security is the only required category. Availability, processing integrity, confidentiality and privacy are included only if you choose them or a customer asks. Adding categories you do not need is the most common way a first SOC 2 becomes expensive.

0 of 16

Scope and system description

Type I or Type II decidedType I is a point in time. Type II covers a period, normally three to twelve months, and is what enterprise buyers actually ask for.ScopingTrust services categories chosenSecurity is mandatory. Each additional category adds criteria, controls and cost.TSCSystem description writtenThe description of your system that the report is built around, and that management asserts is accurate.Section 3Observation period agreed with the auditorFor a Type II. Controls must be operating for the whole period, so this sets your real deadline.Type II

Common criteria: control environment and communication

Governance, ethics and accountability evidencedBoard or leadership oversight, a code of conduct, and defined organisational structure.CC1Internal and external communication of commitmentsHow you tell staff and customers what you commit to, including a published security posture.CC2

Common criteria: risk and monitoring

Risk assessment covering fraud and changeObjectives set, risks identified and analysed, including the risk of fraud.CC3Ongoing and separate evaluations performedMonitoring that would catch a control failure before the auditor does.CC4Control deficiencies tracked to resolutionEvidence that findings are communicated and actually fixed.CC4

Common criteria: the control activities

Logical and physical access controlsProvisioning, review, removal, and protection of the physical environment.CC6System operations and incident responseDetection, response, and documented incidents with evidence of handling.CC7Change managementAuthorised, tested and approved changes, evidenced for the full period.CC8Vendor and business partner risk managementDue diligence on the suppliers your service depends on.CC9

Evidence discipline

Every control has a named ownerAn auditor samples across the period. An unowned control produces no evidence.Operating effectivenessEvidence generated automatically where possibleScreenshots taken the week before the audit do not demonstrate a control operating for six months.Operating effectivenessPopulations are complete and reconcilableThe auditor samples from your population. If it is incomplete, the sample is worthless.Sampling

Your ticks stay in this browser tab and are not saved or sent anywhere. Refreshing clears them.

Keep reading

FrameworkSOC 2: what it is and who assesses it

InsightThe complete guide to SOC 2 certification

ToolWork out which frameworks apply to you

Ticked most of it and stuck on the rest?

SOC 2 is assessed by licensed cpa firm. We run the programme up to that point and manage the assessment itself.

Book a free consultation