Last reviewed: September 2026
No Credit Card Required
Printed from checkflow.io/templates/compliance/soc-2-readiness-checklist
A SOC 2 readiness assessment is a rehearsal of the audit before the observation window opens: someone who did not build the controls tests each one against the AICPA Trust Services Criteria in scope and samples its evidence. This checklist runs the whole readiness project around it, from scoping and gap assessment to an agreed start date.
This free SOC 2 readiness checklist is for whoever has just been told to “get us SOC 2”, usually an engineering, security or operations lead at a SaaS or IT services company with a customer deadline. It runs the readiness project from scoping to the day the observation window opens: report path and categories, system boundary, a gap assessment against the AICPA’s 2017 Trust Services Criteria, remediation, control owners and evidence, choosing a CPA firm and a mock audit. You finish with a signed scope, a closed gap register, a draft system description and a start date your sponsor and auditor have agreed.
A Type 2 report gives a CPA firm’s opinion on whether your controls operated effectively throughout a stated period. A failure inside that period is reported as an exception, and fixing it later does not remove it. Readiness is the work before the clock starts: decide what is being reported on, close the gaps and prove each control produces evidence on demand.
The common mistake is treating the start date as a formality. Once the window is open, a skipped quarterly access review is simply a skipped review. Pushing the start date back costs a month. Starting before the controls are running costs an exception in a report your customers will read.
Work: scoping, gaps, remediation, owners, evidence set-up, mock audit.
Who: an internal lead and an executive sponsor.
Output: a signed scope, a closed gap register and an agreed start date.
Cost of a mistake: time. You move the date.
Work: risk assessment, evidence requests, sampling, testing and reporting.
Who: the service auditor, independent of you.
Output: a report carrying the auditor’s opinion and any exceptions found.
Cost of a mistake: an exception your customers can read.
This checklist stops on the first day of the window. For the categories, typical costs and the controls that run during the audit, read our SOC 2 compliance checklist guide.
Seven phases take a first SOC 2 from a scoping decision to an open observation window. Answers in Phase 1 switch tasks on or off for subservice organisations, extra categories and a Type 1 first report.
The first task carries the scope questions. The category task appears only when categories beyond Security are in scope, and the subservice tasks here and in Phase 4 only when the service relies on one.
Assign this phase to someone who did not build the controls: internal audit, an adviser or the CPA firm under a readiness engagement.
The two Type 1 tasks appear only when the Phase 1 report path is Type 1 first. After this phase, recurring control checklists take over.
The AICPA’s 2017 Trust Services Criteria have five categories. Security is always in scope, through 33 common criteria grouped into nine series, CC1 to CC9. Availability, Confidentiality, Processing Integrity and Privacy add their own criteria only when you choose them in Phase 1. The checklist has no task per criterion: Phase 2 maps your controls to every criterion in scope, and the table shows where each series usually needs work during readiness.
| Criteria | What they cover | What readiness looks for | Where the checklist handles it |
|---|---|---|---|
| CC1 Control environment | Integrity and ethics, oversight, structure, competence and accountability | Approved policies, staff acknowledgements and a named owner for every control | Phases 3 and 4 |
| CC2 Communication and information | Information quality and how responsibilities and commitments are communicated, inside and out | A system description and published commitments that match what runs | Phases 1 and 4 |
| CC3 Risk assessment | Objectives, risk identification and analysis, fraud risk and significant change | A documented risk assessment that names the risks your controls address | Phases 2 and 3 |
| CC4 Monitoring activities | Evaluating whether controls work and reporting deficiencies | Someone checks the controls and every deficiency gets an owner and a date | Phases 4 and 6 |
| CC5 Control activities | Selecting and deploying controls, including technology controls, through policies | Every policy sets a cadence the team can keep | Phases 2 and 3 |
| CC6 Logical and physical access | Granting, changing and removing access, authentication, physical access, and protecting data at the boundary, in transit and on disposal | Joiner and leaver populations, and a quarterly user access review with evidence | Phases 2 and 4 |
| CC7 System operations | Detecting vulnerabilities and anomalies, responding to incidents and recovering | Scans, monitoring and an incident process that leave records, such as a vulnerability management cycle | Phases 2 and 4 |
| CC8 Change management | Authorising, testing, approving and implementing changes | Approved change tickets and a change population you can export for any date range | Phase 4 |
| CC9 Risk mitigation | Business disruption risk, and the risk from vendors and business partners | Vendor reviews and monitoring of each subservice organisation, for example with a vendor risk assessment | Phases 1 and 4 |
| A1 Availability | Capacity, backup and recovery for the commitments you make on uptime | Only when in scope: backups and a recovery test with a dated result | Phase 1 decides |
| C1 Confidentiality | Identifying, protecting and disposing of confidential information | Only when in scope: the confidential data your contracts define, and how it is disposed of | Phase 1 decides |
| PI1 Processing integrity | Complete, valid, accurate and timely processing | Only when in scope: input, processing and output checks for the service | Phase 1 decides |
| P1 to P8 Privacy | Notice, choice, collection, use and retention, access, disclosure, quality and monitoring of personal information | Only when in scope: how personal information is handled across its life | Phase 1 decides |
The descriptions summarise the criteria; read the full wording and points of focus in the AICPA’s 2017 Trust Services Criteria (with revised points of focus, 2022). Once the window opens, the recurring controls carry on in their own checklists; audit management software shows how to schedule internal audits of them between reports.
SOC 2 is not a regulation. It is an attestation report built on AICPA standards and criteria, and the table maps each readiness decision to its source and to the phase that evidences it. Your auditor’s methodology and your customers’ contracts shape the detail, so treat the table as a starting point, not legal advice.
| Readiness decision | AICPA source | What it means in practice | Evidenced in |
|---|---|---|---|
| Report type and period | SOC 2 Guide (updated as of 15 October 2022); attestation standards AT-C 105 and 205 | Type 1 covers design at a point in time; Type 2 covers design and operating effectiveness over a period | Phases 1 and 7 |
| Categories and criteria | TSP section 100: 2017 Trust Services Criteria (with revised points of focus, 2022) | Security (the common criteria) is always in scope; the other four categories are optional | Phases 1 and 2 |
| Points of focus | TSP section 100 | Illustrations of how a criterion can be met; an assessment of each one is not required | Phase 2 |
| System description | DC section 200: 2018 description criteria (with revised implementation guidance, 2022) | Management describes services, commitments, components, subservice organisations and complementary controls | Phases 1 and 4 |
| Subservice organisations | SOC 2 Guide: carve-out or inclusive method | Carve-out leaves the provider’s controls out of scope but discloses the controls you expect it to operate | Phases 1 and 4 |
| Choice of auditor | State licensing and the AICPA Code of Professional Conduct | Only a licensed CPA firm can issue the report, and it must stay independent of you | Phase 5 |
At the time of review, the 2017 criteria and the 2018 description criteria are still current. The AICPA’s Auditing Standards Board exposed proposed revisions to the core attestation standards in February 2026, with a proposed effective date of 15 June 2029; they are not final. In April and May 2026 the AICPA also published ethics guidance on audit firms’ arrangements with SOC 2 tool providers, and a peer review alert about SOC 2 engagements with identical risk assessments, sample sizes and testing across clients. Neither changes what you must evidence, but both are reasons to ask harder questions in Phase 5. If your window starts in 2027, check the AICPA site for newer criteria first.
Each gap from Phase 2 sits in a table inside the task, with its criterion, owner, effort and target date. Retest evidence is attached as a file, and the sponsor sees what is still open without a status meeting.
Phase 1 answers drive conditional logic, so subservice, extra-category and Type 1 tasks appear only when they apply. Scope sign-off and the go or no-go decision are approvals, recorded with who and when.
Each control goes onto a recurring schedule during readiness, with dynamic due dates and a named assignee. The first quarterly cycle has run before the mock audit, so Phase 6 samples real records.
CheckFlow is not a GRC platform, a CPA firm or an auditor, and it cannot issue or certify a SOC 2 report. It runs the readiness project and the human controls that follow, next to your monitoring tools. CheckFlow for SOC 2 shows how those controls keep running once the window is open.
Each subservice organisation you carve out will send you its own SOC report, and customers will review yours the same way. The SOC Report Review Checklist covers that side of the process.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
It is a rehearsal of the audit before the window opens. Someone who did not build the controls walks through each one with its owner, samples evidence as an auditor would and compares the draft system description with what is running. The result is a findings list and a decision on whether the window can start. It is not a report you can give customers.
They sit at opposite ends of the project. A gap assessment comes first: it compares what you do today with the criteria in scope and lists what is missing or unevidenced. A readiness assessment comes last: it tests whether the fixed controls work and produce evidence on demand. This checklist runs them in Phase 2 and Phase 6.
Often, yes, within the AICPA’s independence rules for non-attest services. Your management must make every decision, name a suitably skilled person to oversee the work and accept responsibility for the results. The firm can assess and recommend, but it cannot take on management responsibilities, such as deciding which gaps to fix or running your controls. Some firms keep the two engagements separate, so ask in Phase 5.
Practice and your customers set the length, not a fixed rule. Three months is the shortest period commonly seen and a frequent choice for a first report; 12 months is the usual cadence afterwards. A short first window still has to contain at least one run of every quarterly control. Check what your largest customers accept.
When the readiness assessment says go, not when sales needs it. Every control in scope has run at least once, every owner can produce evidence unaided, populations export for any date range and the draft description matches reality. If any of those is missing, move the date.
No. The Trust Services Criteria do not require any particular tool. Monitoring platforms save time on technical evidence, but people still run access reviews, approve policies and decide scope. If you use one, check that your CPA firm sets its own scope, timing and sampling, and ask about any referral arrangement with the platform.
Security, Availability, Processing Integrity, Confidentiality and Privacy, as set out in the AICPA’s 2017 Trust Services Criteria. Security is always in scope: its 33 common criteria, CC1 to CC9, apply to every SOC 2 report. You add the other four only where your commitments to customers call for them, for example Availability when you sell an uptime SLA.
Yes. A readiness assessment is work you choose to do before the examination, not part of it, so who runs it is up to you. What matters is distance from the work: the tester should not be the person who built or runs the control. Internal audit, an outside adviser or a CPA firm under a separate readiness engagement can all do it. Control owners checking their own controls is a gap assessment, not a rehearsal.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
