SOC 2 Readiness Check
Find the gaps to close before a SOC 2 audit: scope and policies, access and change control, monitoring, vendors and the evidence an auditor will ask for. Not an audit.
- Free
- No sign-up to try
- Works as you type
Answer for the systems and services you'd put in scope. This finds gaps to close before an audit; it isn't an audit, and only an independent auditor can issue a SOC 2 report.
0 of 14 answered
Answer the questions to see your score by area as you go.
Answer at least 12 of 14 questions to save your results as a Room.
How it works
How the SOC 2 Readiness Check works
- 1
Answer the questions
Pick the answer closest to where you are today. It takes a few minutes.
- 2
See your score
Your score by area appears as you answer, with the weakest areas first.
- 3
Save your results
Create a Room with your scores, next steps and an adviser to talk them through.
Worked example
What it makes
14 questions across 5 areas. Each answer scores 0 to 3; an area's score is its points as a share of the most it could get.
Scope and governance
- Have you decided the scope: systems, services and which trust services criteria apply?
- Are security policies written and approved?
- Is someone accountable for getting audit-ready?
Access and change
- How is access to production systems controlled?
- How are code and infrastructure changes approved?
- How are joiners and leavers handled?
Operations and monitoring
- How do you monitor systems and respond to alerts?
- Is there an incident response plan?
- How are backups and recovery handled?
Risk, vendors and people
- Have you assessed the risks to the services in scope?
- How are vendors that touch customer data reviewed?
- Do staff complete security training, with background checks where appropriate?
Evidence
- Could you show evidence that a control worked over the past few months?
- How is evidence collected?
Results bands: Not ready (0+), Getting there (40+), Mostly ready (70+), Ready (90+). A self-assessment from your own answers: a starting point for a conversation, not an audit, certification or professional advice.
Who it's for
Who uses it
Startup founders
See how much work stands between you and a first SOC 2 report.
Engineering leads
Prioritise access, change and monitoring controls.
Compliance owners
Check evidence collection before engaging an auditor.
Good to know
What to consider
- A readiness self-check, not an audit or attestation. Only an independent auditor can issue a SOC 2 report.
- It covers common controls, not your auditor's full requirements; agree scope and criteria with them.
Questions
About the SOC 2 Readiness Check
Why does evidence get its own area?
An audit that covers a period of time looks for proof that controls worked throughout it. Starting evidence collection early is often what decides when you can be audited.
Is this an audit or a certification?
No. It scores your own answers against a written rubric to show where you stand and what to do next. Use it to start a conversation, not as an audit, certification or professional advice.
Make your results now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my resultsRelated
Related tools
- ISO 27001 Readiness CheckRun a gap check against elements commonly expected for ISO 27001, from scope and risk assessment to controls, internal audit and management review. Not a certification audit.
- Security Review ChecklistMake a security review checklist for a new tool or vendor: what it touches, sign-in and access, data handling, vendor evidence and a recorded decision.
- Vendor Risk AssessmentScore a supplier on security, data handling, continuity and business risk using the questions you'd put to them, and see which gaps to close before you rely on them.