# SOC 2 readiness working checklist

Revision: 2026-10-18. Maintained with the [SOC 2 readiness guide](https://auditsuisse.com/soc-2-readiness-checklist-2026).

You may copy, edit and reuse this original working template within your organization. It contains no client data. This is a preparation aid, not a reproduction of AICPA criteria, an auditor opinion or a guarantee of an audit outcome. Confirm applicable criteria, scope and evidence with your auditor. Readiness is optional and separately scoped.

## Define the engagement

- Organization / system:
- Intended report recipients and their requirements:
- Proposed report type (Type I or Type II):
- Proposed examination date or reporting period:
- In-scope services, environments and locations:
- Selected Trust Services Categories:
- Subservice organizations and shared responsibilities:
- Engagement owner:
- Scope questions to resolve with the auditor:

## Assign controls and preparation work

Suggested tasks below are examples to adapt, not a complete or mandatory control list. Use the status values Not assessed, Gap identified, In progress, Ready for auditor assessment, or Not applicable (explain why). A completed task does not establish that a criterion is satisfied.

| Preparation task | Suggested role | Assigned owner | Evidence to locate | Frequency / relevant date or period | Status | Gap / next action | Target date |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Confirm system boundary and customer commitments | Executive / system owner | | System inventory, service description, contracts | Before scoping and on change | Not assessed | | |
| Assign control ownership and escalation responsibilities | Security / operations | | Responsibility register, escalation procedure | On organizational change | Not assessed | | |
| Document risk assessment and treatment decisions | Risk / security | | Risk register, management decisions | Agree a risk-based cadence | Not assessed | | |
| Check access provisioning and termination | IT / HR | | Approval records, access changes, termination tickets | Each relevant personnel event | Not assessed | | |
| Review privileged and user access | System owners | | Access review population, decisions, removals | Agreed control frequency | Not assessed | | |
| Review production change approval and deployment | Engineering | | Change tickets, reviews, deployment records | Each relevant change | Not assessed | | |
| Review vulnerability handling | Security / engineering | | Scan findings, triage, remediation evidence | Risk-based cadence | Not assessed | | |
| Test incident escalation and response | Security / operations | | Response plan, exercise records, lessons learned | Agreed control frequency | Not assessed | | |
| Verify backup restoration arrangements | Infrastructure | | Restore test results, retention settings | Based on recovery commitments | Not assessed | | |
| Review key service providers | Procurement / security | | Due-diligence records, report period, user responsibilities | On onboarding and risk-based review | Not assessed | | |
| Confirm information-handling and retention rules | Privacy / data owners | | Classification, retention policy, deletion records | By data category and obligation | Not assessed | | |
| Check evidence coverage against the proposed period | Control owners | | Dated records, population completeness, explanations of gaps | Before fieldwork | Not assessed | | |

## Evidence handling

Store sensitive evidence in your approved repository. Put references here rather than credentials, personal data, confidential customer information or restricted SOC reports. Preserve records of what actually happened; do not recreate an omitted control as if it had operated. Record exceptions and discuss them with the auditor.

## Questions for scoping

- Which report type and period do recipients require?
- Which controls and supporting evidence fall inside the boundary?
- Is readiness support requested separately, and how is independence addressed?
- Who implements remediation and retains the evidence?
- What is included in the fee, and which services are additional?
- Which dependencies must be met before fieldwork and report review can be scheduled?

## Change log

- 2026-10-18: Initial reusable preparation template.