Free checklist · For Consultants preparing SaaS clients for SOC 2
SOC 2 Readiness Checklist
Most SOC 2 reports cover the Security category, which is assessed against the common criteria CC1–CC9. Use this checklist in a kickoff workshop to see where a client stands before they engage an auditor.
Summarised from the AICPA 2017 Trust Services Criteria for readiness purposes. Your CPA firm determines scope and testing.
Scoping & planning
Choose report type
Type 1 (design at a point in time) or Type 2 (operating effectiveness over 3–12 months).
Select Trust Services Categories
Security is required; add Availability, Confidentiality, Processing Integrity or Privacy only if customers need them.
Define the system boundary
Products, infrastructure, people, data and third parties in scope.
Identify subservice organisations
Cloud and SaaS providers whose controls you rely on (carve-out vs. inclusive).
CC1 – Control environment
Code of conduct acknowledged
Employees acknowledge at hire and annually.
Org chart and security responsibilities
Named owner for the security program; roles documented.
Background checks
Performed for new hires where legally permitted.
Security awareness training
At onboarding and at least annually, with completion records.
CC2 – Communication & information
Policies published to staff
Information security policy set approved and accessible.
System description drafted
Narrative of the system for the report's Section III.
External communication channels
Customers can report incidents and security issues.
CC3 – Risk assessment
Annual risk assessment
Documented identification, scoring and treatment of risks.
Fraud risk considered
Risk assessment explicitly covers fraud.
Vendor risk assessment
Critical vendors reviewed before onboarding and periodically.
CC4 – Monitoring activities
Control self-assessments
Periodic internal checks that controls operate.
Deficiency tracking
Findings logged, assigned and remediated.
CC5 – Control activities
Controls mapped to risks
Each significant risk has a mitigating control.
Policies operationalised
Procedures exist for each policy commitment.
CC6 – Logical & physical access
MFA on production and critical SaaS
Enforced for all users with access to customer data.
Access provisioning & deprovisioning
Approved requests; access removed promptly at termination.
Quarterly access reviews
Evidence of review and remediation retained.
Encryption in transit and at rest
TLS for data in transit; encryption for stored customer data.
Endpoint protection
Disk encryption, screen lock and anti-malware on laptops.
CC7 – System operations
Logging and alerting
Security events collected and reviewed.
Vulnerability management
Regular scanning; remediation SLAs by severity.
Penetration test
Performed at least annually by an independent party.
Incident response plan
Documented, tested, with post-incident reviews.
CC8 – Change management
Change approval
Peer review / approval before production deployment.
Separation of environments
Development, test and production separated.
CC9 – Risk mitigation
Business continuity & DR plan
Documented and tested; backups restored periodically.
Vendor management program
Contracts, SOC reports or questionnaires for critical vendors.
Cyber insurance considered
Risk transfer evaluated.
Get the full SOC 2 Readiness Checklist
All 32 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
SOC 2 is pre-loaded in every NovaGRC plan: assign control owners per client, attach evidence, request documents from client staff without logins, and track audit readiness.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.
