SOC 2 Readiness Checklist

Scoping

• Decide which Trust Services Criteria categories actually apply to what your service promises customers, beyond the mandatory Security category
• Define the system boundary precisely — what's actually in scope for the audit

Control implementation

• Access control and access review processes are documented and operating
• Change management process is documented and evidenced for every production change
• Monitoring and alerting cover the in-scope system's actual operational risks
• Vendor and sub-processor risk assessment is documented for every third party touching in-scope data

Before engaging the auditor

• Run an internal or consultant-led readiness assessment and remediate the gaps it finds
• Confirm evidence collection is continuous, not a scramble assembled right before fieldwork
• Decide on Type II as the real target — Type I is a weaker stopgap, not a stopping point