Practical SOC 2 Guide
SOC 2 Readiness: From Checklist to Evidence
Turn the existing 16-item checklist into an organized work plan across policies, people, access, operations and evidence.
Open the Free ChecklistSet Your Scope Before You Start
Confirm the systems, services and applicable Trust Services Criteria with your auditor. Use this guide alongside the SOC 2 readiness checklist, not as a complete audit program or a guarantee of certification. Its five areas and 16 items stay unchanged.
For each item, record its owner, current status, evidence location and next action. Separate “document drafted” from “control implemented” and “evidence collected.” An AI-generated document is a starting point for review, not proof that a control operates.
01 · Policies
Start With Approved Policies
The checklist covers a published information security policy, signed acceptable use acknowledgments, and access control, change management and incident response policies. Identify which documents already exist, who approves them and where employees can find the current versions.
Evidence to organize: Save approved policies and employee acknowledgments, not just unsigned drafts.
Start a Information Security Policy02 · People
Connect Documents to Employee Processes
Review background checks, yearly security awareness training, and recorded onboarding and offboarding checklists. Assign HR and security owners to confirm what actually happens when someone joins or leaves. Describe your real process before generating supporting documents.
Evidence to organize: Collect training records and completed onboarding and offboarding checklists.
Start a Employee Onboarding SOP03 · Access
Check Access and Record Reviews
The checklist calls for multi-factor sign-in on key systems, quarterly access reviews with sign-off, and access removal within 24 hours of leaving. Inventory the systems in scope, identify reviewers and record removals. These are this checklist’s readiness targets; confirm the appropriate commitments for your organization with your auditor.
Evidence to organize: Keep review approvals and account-removal records alongside the access procedure.
Start a User Access Review SOP04 · Operations
Track Risks and Operational Follow-Through
Review the risk register at least yearly, assess critical vendors, test backups and record restore results, and track vulnerability scan findings. A written procedure explains the work; completed assessments, test results and remediation records show the work was performed.
Evidence to organize: Give each open risk or finding an owner, next action and target date.
Start a Risk Register05 · Evidence
Build a Navigable Evidence Set
The checklist includes an evidence tracker with an owner and due date per control, an incident log even when empty, and a drafted management assertion letter. Use the tracker to link policies and operating records to the relevant controls, and have management review the assertion letter with the auditor.
Evidence to organize: Review missing evidence with its owner before treating a checklist item as complete.
Start a Evidence Collection TrackerReview, Tailor and Keep the Records
When generating a draft, add your industry, company, systems, responsible roles and actual procedures. Review it with the people who perform the work, obtain the needed approvals and export the reviewed version. Revisit open checklist items as evidence arrives and confirm readiness with your auditor.
Need additional policies? Explore SOC 2 policy templates or all SOC 2 Type II templates for procedures, plans and supporting trackers. Your first generated document is free.