Free SOC 2 Readiness Check

How to use it

Answer each question honestly. Count your Yes answers, then find your score below. Only answer Yes if it is true today and you could show evidence.

Policies

1. Do you have a written, approved information security policy? Yes / No
2. Does each policy have a named owner and a yearly review date? Yes / No

Access control

3. Do you use MFA on email, cloud and code accounts? Yes / No
4. Do you remove access within a set time when someone leaves? Yes / No

Vendor management

5. Do you keep a list of vendors that handle your data, with their security reports? Yes / No

Change management

6. Are code or system changes reviewed and approved before going live? Yes / No

Incident response

7. Do you have a written incident response plan your team knows how to use? Yes / No

Risk assessment

8. Have you done a written risk assessment in the last 12 months? Yes / No

Monitoring and logging

9. Do you collect and keep logs for key systems? Yes / No
10. Does someone review alerts or logs on a regular schedule? Yes / No

HR and security training

11. Do new hires complete security training and sign policies? Yes / No
12. Do you run background checks or yearly refresher training? Yes / No

Your score

This self-check is for planning only. It is not an audit, and a high score does not guarantee a SOC 2 report. Your independent CPA firm performs the examination.