SOC 2 Readiness Checklist

SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA for service organizations that store or process customer data. Companies — especially SaaS providers — need SOC 2 certification to prove to enterprise customers that they have adequate controls over security, availability, processing integrity, confidentiality, and privacy. This checklist helps teams systematically verify that all required controls are in place before engaging an auditor.

The five criteria are: (1) Security (Common Criteria, CC) — 20 controls covering access management, vulnerability management, incident response, and change management; (2) Availability (A) — 3 controls for system uptime and disaster recovery; (3) Processing Integrity (PI) — 5 controls ensuring data is processed completely and accurately; (4) Confidentiality (C) — 3 controls for data classification and access restriction; (5) Privacy (P) — 9 controls for personal data collection, use, retention, and subject rights.

Yes. Each item uses the official AICPA criteria code (e.g., CC6.1, A1.3, P8.1) and describes the specific control requirement that auditors evaluate. While this checklist provides comprehensive coverage of the core criteria, a formal SOC 2 audit conducted by a licensed CPA firm will include additional testing procedures and evidence review beyond what a self-assessment checklist can cover.

SOC 2 Type I assesses whether your controls are suitably designed at a specific point in time. SOC 2 Type II assesses whether those controls operated effectively over an observation period (typically 6-12 months). This readiness checklist is most useful during preparation for a Type I audit, or during the observation period leading up to a Type II audit. Checking off all items indicates design completeness but does not substitute for the operational evidence required in Type II.

Progress is maintained only during your current browser session because no data is sent to a server. If you need to track progress across multiple sessions, take a screenshot of your checked items, or note which categories and criteria codes are complete. Future browser sessions will start with all items unchecked.

Based on typical readiness gaps, the most frequently missing controls are: CC6.8 (vulnerability management), CC7.2 (anomaly monitoring / SIEM), CC7.3 (incident response plan testing), CC8.1 (formal change management process), and A1.3 (disaster recovery testing). Privacy criteria (P1.1 through P8.1) are also commonly underdeveloped in companies that are new to data privacy compliance.

For a startup with minimal existing controls, achieving full SOC 2 readiness typically takes 3-6 months. Companies with existing security infrastructure (SSO, MFA, endpoint management, logging) can often reach readiness in 6-12 weeks. The most time-consuming areas are usually implementing a formal change management process, establishing an incident response program, and completing vendor risk assessments.

No. Security (Common Criteria) is the only mandatory category. Availability, Processing Integrity, Confidentiality, and Privacy are optional add-on criteria that companies include based on their service commitments to customers. Most SaaS companies start with Security only, then add Availability and Confidentiality. Privacy is typically added when the service processes significant personal data and when customers specifically request it.