A SOC 2 report demonstrates that your organization's controls meet the AICPA Trust Service Criteria. Customers and partners often require it before sharing data. This guide gives you a practical SOC 2 audit readiness checklist and what auditors expect.
Trust Service Criteria (TSC)
SOC 2 is built on five categories:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
- Security: Protection against unauthorized access (common to all SOC 2 reports).
- Availability: System availability as committed.
- Processing Integrity: Processing is complete, valid, and authorized.
- Confidentiality: Confidential information is protected.
- Privacy: Personal information is collected, used, retained, and disclosed in line with your privacy notice.
Most organizations start with Security; you add other categories as needed. Type I reports on the design of controls at a point in time; Type II reports on operational effectiveness over a period (e.g. 6–12 months).
SOC 2 Audit Readiness Checklist
Policies and Documentation
- Information security policy (and other relevant policies) documented, versioned, and approved.
- Policy acknowledgment/attestation records for personnel. Policy management with version control and attestation tracking is essential.
- Risk assessment documenting identified risks and how they're addressed.
Access Control
- Access reviews performed periodically (e.g. quarterly) with evidence of who reviewed and when.
- Role-based access; removal of access when people leave or change roles.
- Multi-factor authentication (MFA) where required by your controls.
Change and Operations
- Change management process: approval, testing, deployment. Evidence of changes and approvals.
- Incident response process: detection, response, escalation, post-incident review. Log of incidents and outcomes.
- Backup and recovery: RTO/RPO defined and tested; evidence of tests.
Vendor and Third-Party Risk
- Inventory of vendors that handle sensitive data.
- Due diligence and ongoing monitoring (questionnaires, certifications). TPRM practices supported by your GRC tool.
Continuous Monitoring
- Auditors expect consistent evidence over time, not a last-minute dump of spreadsheets. Automated evidence collection (e.g. from IdP, cloud, HR) shows controls are operating. A platform like ActiveERM automates control testing and evidence so you stay audit-ready year-round.
After the Audit
Use the audit as a catalyst to keep controls and evidence in one place. Link SOC 2 controls to your risk register and audit findings so that when something changes, you update once. For more on audit management and evidence, see our Audit Management and GRC Cloud pages.