← All platforms / Tools Free tool
SOC 2 Compliance Checklist: Interactive Readiness Tracker
Work through the controls most SOC 2 audits look at. Tick items off as you go; your progress is saved in this browser.
Scope and governance Decide which Trust Services Criteria are in scope (Security is always required) Define the system boundary: products, infrastructure, people and data in scope Assign an owner for the SOC 2 program and for each control area Complete a risk assessment and document how risks are treated Approve an information security policy and supporting policies People Run background checks for new hires where legally allowed Collect signed acceptable-use and confidentiality agreements Deliver security awareness training at onboarding and annually Document onboarding and offboarding steps, including access removal Access control Enforce SSO or MFA on production systems and key SaaS tools Grant access by role and least privilege, with approvals recorded Review user access on a set schedule (for example quarterly) Remove access promptly when people leave or change roles Systems and change management Require peer review and approval before code reaches production Separate development, staging and production environments Encrypt data at rest and in transit Manage laptops with MDM (disk encryption, screen lock, updates) Patch systems and track vulnerabilities to resolution Monitoring and incident response Centralize logging and alerting for production systems Write and test an incident response plan Track security incidents and document follow-up actions Run a penetration test and remediate findings Business continuity Back up critical data and test restores Document a business continuity and disaster recovery plan Test the continuity plan at least annually Vendors Keep an inventory of vendors that touch customer data Review vendor security (their SOC 2 reports or questionnaires) before onboarding and annually Put data processing and confidentiality terms in vendor contracts Audit readiness Pick an audit firm and agree scope and report type Choose a Type 2 observation window Collect evidence for each control in one place Prepare the system description This is a planning aid, not an audit standard. Your auditor sets the final control list based on your scope. A compliance platform can track these items and collect evidence automatically.