SOC 2 Readiness Checklist: How to Gap-Assess Before Your First Audit

Buyers and enterprise customers keep asking “Do you have a SOC 2?” Before you hire an auditor, you need a clear picture of where you stand. A SOC 2 readiness checklist turns that pressure into a practical gap list.

This guide explains what readiness means, how Type I and Type II differ, which Trust Services Criteria matter first, and how to run a self-assessment you can share with leadership. It also points to a free PDF checklist and templates that help you track controls and evidence.

What SOC 2 readiness actually means

SOC 2 is not a badge you buy. An independent CPA firm issues a SOC 2 report after reviewing how your company designs (and for Type II, operates) controls against the AICPA Trust Services Criteria. Readiness is the work you do before that engagement so the audit is not a scramble.

A readiness review asks: Have we defined our system and in-scope services? Do policies match how we work? Are technical and people controls in place? Can we produce evidence on demand? Gaps found here are far cheaper to fix than surprises mid-audit.

Type I vs Type II, in plain English

• Type I looks at whether controls are suitably designed at a point in time.
• Type II looks at whether those controls operated effectively over a period, often three to twelve months.
• Most enterprise buyers prefer Type II once you are ready, but many teams start with a gap assessment, then Type I, then a Type II observation window.

Your checklist should flag both design gaps (missing policy or control) and operating gaps (control exists but you cannot prove it ran).

The Trust Services Criteria that matter first

Security is required for every SOC 2. The others are optional based on your product and customer promises:

• Security (required): protect systems against unauthorized access.
• Availability: the system is available as committed.
• Confidentiality: confidential information is protected as committed.
• Processing Integrity: processing is complete, valid, accurate and authorized.
• Privacy: personal information is handled in line with commitments.

Most SaaS startups begin with Security only, then add Availability or Confidentiality when customers ask. Note your planned categories on the checklist so scope does not creep.

What to put on a SOC 2 readiness checklist

Cover these six areas the way auditors think:

• Scope and ownership: system description draft, in-scope services, cloud accounts, key vendors and a named program owner.
• Policies: information security, access control, change management, incident response, acceptable use, vendor management and data retention.
• Technical controls: MFA, logging, backups, vulnerability management, encryption and network boundaries.
• People and operations: training, joiner and leaver access processes and device standards.
• Change and incident management: ticketed changes, severity levels and a tested response path.
• Evidence preparation: a folder or tool where screenshots, tickets, access reviews and approvals live by control.

Start with the free SOC 2 Readiness Self-Assessment Checklist (PDF). It is a two-page tick-box review for SaaS teams: six sections of checks plus a plain-language reminder of Type I vs Type II and the Trust Services Criteria. It guides a gap review; it does not replace an auditor.

How to run the self-assessment in one afternoon

1. Walk the checklist with whoever owns security, engineering and people ops.
2. Mark each item Met, Partial or Missing. Partial counts as a gap until evidence exists.
3. For every Partial or Missing item, write one owner and a target date.
4. Group gaps into this month, next quarter and after we pick an auditor.
5. Share a one-page summary with leadership: scope, top ten gaps and a rough timeline.

A green checklist is not a certificate. Auditors still test design and, for Type II, operating effectiveness against your evidence.

Evidence to start collecting now

• Access review exports and tickets showing removals were completed
• New-hire and offboarding checklists with dates
• Change tickets linked to deploys or pull requests
• Incident tickets with severity, timeline and follow-up notes
• Policy approvals and training completion logs
• Vendor list with security review status for critical providers

Free helpers: the Employee Offboarding Access Removal Checklist, the Security Incident First 24 Hours Checklist and the Compliance Evidence Request Tracker for chasing proof from control owners.

When a control register and light automation help

Once the gap list is clear, many teams need owners, next-due dates and overdue flags. The SOC 2 Compliance Automation Pack ($149 one-time) is an 80-control Excel or Google Sheets command center mapped to the 2017 Trust Services Criteria, plus six n8n workflows for evidence reminders, access review kickoffs, overdue escalations and joiner/leaver checklists, with a setup guide. It organizes readiness work; it does not certify you or replace an auditor.

If you want that pack configured in your tools, the SOC 2 Compliance Automation Setup service ($950) assigns owners and gets the workflows running in your n8n. Readiness support only, not an audit.

Related frameworks and questionnaires

Federal supply-chain work is a different path: see our CMMC Level 1 self-assessment template. If AI tools are in your product or ops, keep an AI risk register and an AI acceptable use policy. For buyer questionnaires that arrive before any audit, use the Security Questionnaire Response Prep Checklist.

Download the free checklist and close your top gaps

Get the free SOC 2 Readiness Self-Assessment Checklist and mark every item Met, Partial or Missing this week. When you are ready to track controls and automate reminders, move up to the SOC 2 Compliance Automation Pack or browse more templates in the cyhornet.ai marketplace.

General information only, not legal advice. Templates and checklists do not guarantee SOC 2 compliance, attestation or certification, and they do not replace an independent auditor.

Frequently asked questions

What is a SOC 2 readiness checklist?

It is a structured list of scope, policy, technical, people, change, incident and evidence items you review before a SOC 2 audit so you can find gaps early.

Is a SOC 2 readiness checklist the same as a SOC 2 report?

No. A readiness checklist helps you prepare. A SOC 2 report is issued by an independent CPA firm after it evaluates your controls.

Should we start with Type I or Type II?

Many teams gap-assess first, then pursue Type I to prove design, then Type II once controls have operated for an observation period. Ask your target customers which they require.

Which Trust Services Criteria do we need?

Security is required. Availability, Confidentiality, Processing Integrity and Privacy are optional and depend on your product and customer commitments.

Does the free SOC 2 readiness checklist certify us?

No. The free PDF guides a self-assessment only. It does not provide compliance, attestation or certification.

What does the SOC 2 Compliance Automation Pack include?

An 80-control Excel or Google Sheets command center mapped to the Trust Services Criteria, six n8n workflows for reminders and reviews, plus a setup guide. It organizes readiness work; it does not replace an auditor.