SOC 2 Readiness Checklist

The system description is the foundation of a SOC 2 report — auditors will check it closely.

Active leadership oversight is a foundational SOC 2 common criteria requirement.

Policies must be current, approved and demonstrably communicated — not just written.

Auditors expect traceability from each control to the applicable Trust Services Criteria.

Risk assessment should drive control selection and monitoring focus for SOC 2.

SOC 2 auditors sample change records — they need to show authorisation, testing and recoverability.

Access controls are heavily sampled in SOC 2 Type 2 — expect auditors to pull JML records.

Systems must process data accurately, completely and as authorised.

SOC 2 requires you to manage risk introduced by vendors who access or process your systems.

Monitoring must demonstrate timely detection and response to security events.

Preparedness and learning from incidents is a key SOC 2 common criteria expectation.

Type 2 auditors sample evidence across the audit period — it must be organised and retrievable.

If Availability is in scope, auditors will look for both architecture and tested recovery evidence.

Sensitive data must be protected throughout its lifecycle — encryption configuration is sampled.

Privacy criteria require evidence of notice, consent handling and individual rights management.

Clear planning aligned with your auditor reduces delays and scope disputes.