SOC 2 Readiness Checklist (2026): The Control-by-Control Guide with Owners and Evidence

SOC 2 readiness in one page

SOC 2 is governed by the AICPA’s 2017 Trust Services Criteria (with revised points of focus, 2022). An independent, licensed CPA firm examines management’s description of the system against those criteria and issues an opinion under the attestation standards (SSAE 18, AT-C section 205). Getting “ready” means every applicable criterion has a designed control, a named owner, and evidence that the control operated.

There are five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security — the Common Criteria — is the only mandatory category; the other four are added based on your services and customer commitments. The Common Criteria are organized into nine sections, CC1 through CC9, and the first five (CC1–CC5) map directly to the 17 principles of the COSO 2013 Internal Control – Integrated Framework that the criteria are built on. For the full taxonomy of each criterion, see our SOC 2 controls list by Trust Services Criteria; this page is the actionable worklist you run against it.

On budget and timeline, industry ranges are wide and no substitute for a scoped quote: a standalone readiness assessment commonly runs roughly $5K–$25K (external engagements often start near $10K), total first-year SOC 2 spend often lands between $30K–$150K depending on scope, readiness takes about one to five months, and a focused gap analysis one to four weeks. What’s new for 2026: buyers push security questionnaires earlier and expect near-continuous monitoring, and vendor and AI-tooling risk now draws direct scrutiny under CC9.2 (assessing vulnerabilities from vendor and business-partner relationships).

“The teams that sail through fieldwork are the ones that turned this checklist into calendar events months earlier — an owner on every control and the evidence generated in the normal course of work, not reconstructed the week before we arrive.”

— Sébastien Ruosch, CPA, Director of Audits at Auditsuisse

How to use this checklist (Type I vs Type II)

The checklist items are the same whether you pursue a Type I or a Type II — both examine controls against the identical Trust Services Criteria. What changes is the evidence window. A SOC 2 Type I attests to the suitability of the design of controls at a single point in time; a Type II attests to design and operating effectiveness over a period. That distinction dictates how much evidence you pre-stage and how early you must finish this list.

Practical rule: complete the checklist, then let controls run. For a Type II, any item still open when the observation clock starts is likely to surface as an exception, because there is no way to demonstrate it operated for the full window.

Step 1 — Define your audit scope and select Trust Services Criteria

Scope is the highest-leverage decision on this list because it cascades into every downstream control, evidence request, and cost driver. Start by drawing your system boundary: the infrastructure, software, people, data, and processes that deliver the service your customers rely on. Document data flows end to end, then decide which of the five categories are in scope. Almost everyone selects Security; add Availability if you make uptime commitments, Confidentiality if you handle sensitive customer data under NDA, Processing Integrity for transaction or data-processing services, and Privacy if you collect personal information. For the mechanics of drawing the boundary, follow our guide on how to scope systems for SOC 2.

Two scoping concepts trip up first-timers. Subservice organizations are the vendors that host or operate parts of your system (for example, your cloud provider). You either carve them out of your report — relying on their own SOC 2 and defining Complementary Subservice Organization Controls (CSOCs) — or use the inclusive method and test them directly. Separately, Complementary User Entity Controls (CUECs) are the controls your customers must operate for your controls to work (such as configuring their own SSO correctly); these belong in your system description, not your control set. Getting the carve-out boundary and CUECs right up front prevents a scope rewrite during fieldwork.

Step 2 — Assign control owners

Assign every control to a role, not a named person — people change, roles persist, and auditors evaluate whether responsibilities are clear and consistently executed over time. A lightweight RACI at the domain level is enough to start: an accountable owner, the contributing teams, a cadence, and the system of record where the evidence lives. This single table prevents the most common readiness failure, fragmented ownership, where engineering, IT, security, and legal each work from a different definition of “done.”

The SOC 2 readiness checklist by Trust Services Criteria

Below is the master worklist grouped by Common Criteria section. Each item names the mapped criterion, the owning role, and the evidence artifact an auditor will request. Work top to bottom; the access, operations, and change-management sections (CC6–CC8) draw the deepest scrutiny in every engagement. For the underlying criteria definitions behind each item, cross-reference the full controls list by Trust Services Criteria.

CC1 — Control Environment

CC1 establishes governance, integrity, and accountability. It maps to COSO’s control-environment component (principles 1–5). Note that the 2022 revised points of focus refined CC1.3 (adding a privacy-reporting-line consideration) and CC1.5 (accountability).

CC2 — Communication & Information

CC2 covers how security information is generated and communicated internally and externally. The 2022 points of focus refreshed CC2.1 around asset classification and quality of information.

CC3 — Risk Assessment

CC3 requires a documented, repeatable risk process, including fraud consideration. The 2022 points of focus updated CC3.2 (identifying risks, including from vendors and partners) and CC3.4 (assessing changes in internal and external threats).

CC4 — Monitoring Activities

CC4 covers ongoing and separate evaluations of your controls and how deficiencies are tracked to resolution.

CC5 — Control Activities

CC5 is where policy becomes procedure. It maps to COSO’s control-activities component and covers segregation of duties and technology general controls.

CC6 — Logical & Physical Access Controls

CC6 is the most heavily tested section — it contains eight criteria (CC6.1–CC6.8), the most of any section. Expect deep sampling of provisioning, access reviews, and encryption. Get this block right and most engagements go smoothly.

CC7 — System Operations

CC7 contains five criteria (CC7.1–CC7.5) covering monitoring, vulnerability management, and incident response — the detect-and-respond core of the program.

CC8 — Change Management

CC8 (CC8.1) covers the SDLC: how changes are requested, reviewed, tested, approved, and deployed, including patching.

CC9 — Risk Mitigation

CC9 covers how you mitigate risk from business disruptions (CC9.1) and from vendor and business-partner relationships (CC9.2). Note the mapping nuance: CC9.1 addresses risk-mitigation planning for disruptions, but the operational recovery objectives — backups and recovery testing — are anchored in the Availability category (A1.2, A1.3), not CC9. The 2022 points of focus specifically expanded CC9.2 to assess vulnerabilities arising from vendor and business-partner relationships.

Optional categories — Availability, Processing Integrity, Confidentiality, Privacy

Add these only where they match your services and customer commitments. This is also where operational business continuity and disaster recovery (BC/DR) properly live, under Availability.

Policy documentation checklist

Auditors expect a written, approved, and communicated policy behind the operating controls above. Policies alone do not pass an audit — operating effectiveness does — but missing or stale policies are among the most common early findings. Each policy needs an owner and a review cadence (annual is standard).

Evidence strategy — what auditors accept and how to collect it

Evidence quality determines audit velocity. Strong evidence is complete, timely, attributable, and reproducible: each artifact shows who performed the control, when, what was reviewed, and how exceptions were handled. Screenshots alone rarely satisfy this bar — a screenshot proves a setting on one day, whereas a system-generated report (a config export, an audit log, a ticket history) demonstrates the control operated across the period. For a Type II, favor system reports and pull them throughout the window, not the week before fieldwork.

Store evidence in a governed repository with stable naming and version control, and retain it for at least the full observation period. On the tooling question: compliance automation platforms such as Vanta, Drata, Secureframe, and Sprinto connect directly to systems like Okta, AWS, and GitHub to collect much of this evidence continuously and flag drift. That accelerates readiness, but the platform cannot issue the opinion — at fieldwork the platform exports the evidence to the CPA firm, which independently examines it and signs the report. The platform is the evidence engine; the licensed CPA firm is the auditor.

Run a readiness (gap) assessment before fieldwork

A readiness assessment is the pre-audit dry run that turns this checklist into a scored plan. Strictly, the gap analysis is one component — the control-mapping diagnostic that compares your current controls against the criteria — nested inside the broader readiness assessment, which also covers scope selection, the system description, and evidence preparation. It produces no formal opinion; its job is to surface missing controls and weak evidence while you can still fix them cheaply. It is optional but strongly recommended for first-time auditees.

A useful and often-misunderstood point about independence: under AICPA rules, the same CPA firm that will issue your SOC 2 opinion may perform the readiness assessment as a separate non-attest service, provided it applies safeguards for the self-review threat — management owns every remediation decision, and the firm does not later audit its own work product. This lets you keep one expert team across readiness and audit rather than paying two firms to learn your environment. Our audit methodology details how we run that hand-off cleanly.

Readiness timeline and sequencing

Readiness typically runs one to five months for a first-time team, with the gap analysis itself taking one to four weeks. Sequence the work so scope and ownership are settled before you spend effort implementing controls, and so all controls are live before any Type II observation window opens. For the full end-to-end schedule through fieldwork and report delivery, see our SOC 2 audit timeline.

Common gaps this checklist prevents

Most first-time exceptions cluster in a handful of predictable places: incomplete or late user access reviews, deprovisioning that lags terminations, change tickets missing approvals, vulnerability findings without remediation evidence, and BC/DR plans that were never actually tested. Each maps to a specific item above — which is why finishing the checklist before the window opens is the cheapest possible insurance. For remediation detail on each pattern, see our guide to common SOC 2 findings and how to fix them.

Multi-framework leverage — reusing SOC 2 evidence for HIPAA and GDPR

Most SOC 2 controls do double duty. If you handle protected health information, the access, encryption, logging, incident-response, and vendor controls above overlap substantially with the safeguards expected under a HIPAA program — map them once and collect evidence once. Similarly, teams serving EU customers can reuse the Privacy (P1–P8), access, and vendor evidence to support GDPR obligations, layering framework-specific requirements on top. The winning pattern is one control register, one evidence repository, and one governance cadence with framework overlays, rather than parallel programs that duplicate testing and burn out the same owners.

Download the SOC 2 readiness checklist

Want this as a working spreadsheet with the checkboxes, owners, and evidence columns ready to assign? We’ll send the full control-by-control template — and, on a short scoping call, tell you exactly which optional categories your buyers will require — when you book time with our team. It is the same worklist we run with clients before fieldwork.