The SOC 2 checklist
Everything you need to prepare for SOC 2 Type I and Type II. Use this list to track your readiness across all five Trust Services Categories.
Common Criteria: required for all SOC 2 audits
The Security category (Common Criteria) is the only mandatory Trust Services Category. Every SOC 2 audit includes all CC controls.
Availability, Confidentiality, Privacy, and Processing Integrity
Add these categories when your customers or contracts require them.
Availability (A1)
System availability commitments documented, uptime monitored, capacity managed, and backup/recovery tested. Required when SLAs are in scope.
Processing Integrity (PI1)
System processing is complete, valid, accurate, timely, and authorized. Required for financial transaction or data processing services.
Confidentiality (C1)
Information designated confidential is protected during collection, use, retention, disclosure, and disposal. Required when handling confidential client data.
Privacy (P1-P8)
Personal information collected, used, retained, disclosed, and disposed of according to the privacy notice. Required when handling personal data, especially for GDPR-adjacent scopes.
Policies and documentation to prepare
Every control needs a policy that describes how your organization implements it. Start with these.
Information security policy
Top-level policy covering your security objectives, roles, and governance structure.
Access control policy
Covers how access is provisioned, reviewed, and revoked across all systems.
Incident response plan
Detection, classification, escalation, containment, and post-mortem procedures.
Risk assessment
Annual risk assessment document covering identified risks, likelihood, impact, and mitigations.
Vendor management policy
How third-party vendors are evaluated, approved, and monitored.
Change management policy
Process for requesting, approving, testing, and deploying system changes.
Business continuity plan
Recovery objectives (RTO/RPO), backup schedules, and tested recovery procedures.
Acceptable use policy
Rules governing employee use of company systems and data.
Frequently asked
What is on a SOC 2 checklist?
The Common Criteria (CC) controls covering access management, encryption, incident response, risk assessment, vendor management, and change management. Plus optional categories for Availability, Processing Integrity, Confidentiality, and Privacy depending on your services.
How long does it take to complete a SOC 2 checklist?
Most startups need 4 to 8 weeks for Type I readiness. Type II adds a 3 to 12 month observation period. Automation software reduces the time spent on evidence collection significantly.
Do I need all 5 Trust Services Categories?
No. Security (Common Criteria) is the only mandatory category. You add the others based on what your customers require and what services you offer.
What is the difference between SOC 2 Type I and Type II?
Type I is a point-in-time assessment. Type II tests whether controls operated effectively over 3 to 12 months. Enterprise customers almost always require Type II.
See also: SOC 2 overview and SOC 2 timeline
Get SOC 2 audit-ready faster