SOC 2 checklist

Ten steps from "we need SOC 2" to a report in hand. Want to track it? Use the free interactive readiness checklist. It gives you a progress score and prints cleanly.

  1. Decide report type. Type 1 (point in time) or Type 2 (operating effectiveness over a period). See Type 1 vs Type 2.
  2. Define scope. Which systems, products, people and data are in the audit. Pick Trust Services Criteria: Security is mandatory; Availability, Processing Integrity, Confidentiality and Privacy are optional.
  3. Run a gap assessment. Compare current controls against the criteria. A compliance platform or a readiness engagement can do this.
  4. Write core policies. Information security, access control, change management, incident response, vendor management, business continuity, data retention.
  5. Implement technical controls. SSO/MFA, least-privilege access, encryption, logging and monitoring, vulnerability management, backups, secure SDLC with code review.
  6. Implement people controls. Background checks where lawful, security awareness training, onboarding/offboarding checklists, policy acknowledgements.
  7. Vendor risk management. Inventory sub-processors and collect their SOC reports.
  8. Choose an auditor early. Engage a CPA firm during preparation. Compare firms in the auditor directory.
  9. Collect evidence. Manually or through automation. For Type 2, evidence must cover the whole observation period.
  10. Audit and report. Fieldwork, then report delivery. Drata cites 2–5 weeks of fieldwork and 2–6 weeks for drafting.

Next: Readiness checklist tool · Cost calculator · Timeline · Compare compliance software

Frequently asked questions

What is on a SOC 2 checklist?

Scope and criteria selection, gap assessment, policies, technical and people controls, vendor management, auditor selection, evidence collection and the audit itself.

Is there an official AICPA SOC 2 checklist?

No. The AICPA publishes the Trust Services Criteria and SOC 2 guidance, not a startup checklist. Checklists like this one are planning aids.

Which Trust Services Criteria are required?

Security is mandatory. The other four are chosen based on your commitments to customers.

Last verified 2026-10-16.