SOC 2 Readiness Checklist · SOC 2 Advisor

Scope & governance

Someone owns securityA named person is accountable for the security program, and leadership reviews it at least once a year.CC1.2Defined system boundaryYou can list the product, infrastructure, data stores and teams the report would cover.CC2.1Written security policiesPolicies exist, are approved, and employees acknowledge them.CC5.3Documented risk assessmentYou've assessed risks to the system in the last 12 months and recorded how each is handled.CC3.2

People

Background checks at hireChecks are run for new employees and contractors where local law allows.CC1.4Security awareness trainingEveryone completes training at hire and annually, and completions are recorded.CC2.2Code of conductEmployees acknowledge a code of conduct or acceptable use policy.CC1.1

Access control

SSO and MFAProduction, cloud consoles, code repos and admin tools sit behind SSO with MFA enforced.CC6.1Tracked onboarding and offboardingAccess is granted from a ticket or HR record and removed within a set time after termination.CC6.2Periodic access reviewsAccess to critical systems is reviewed at least quarterly, with sign-off recorded.CC6.3EncryptionCustomer data is encrypted in transit and at rest.CC6.7Endpoint protectionCompany laptops have disk encryption, screen lock and EDR or anti-malware, managed centrally.CC6.8

Operations

Vulnerability managementInfrastructure and dependencies are scanned, and findings are fixed within defined timeframes.CC7.1Logging and alertingSecurity-relevant logs are kept centrally, and alerts reach someone who triages them.CC7.2Incident response planA written plan exists and has been exercised in the last 12 months.CC7.4Change managementProduction changes go through peer review, and direct pushes to main are blocked.CC8.1Backups testedBackups run automatically and restores have been tested.A1.2

Vendors & continuity

Vendor inventory and reviewYou know which vendors touch customer data and have reviewed their security (often via their SOC 2).CC9.2Business continuity planA continuity and disaster recovery plan exists and has been reviewed in the last year.CC9.1Customer commitments documentedSecurity commitments in your contracts, terms or trust page are written down and match what you do.CC2.3

How close are you to a SOC 2 audit?