Compliance Checklist
SOC 2 Compliance Checklist (2026)
Security — CC1: Control Environment
Security — CC2: Communication
Security — CC3: Risk Assessment
Security — CC4: Monitoring
Security — CC5: Control Activities
Security — CC6: Logical & Physical Access
Security — CC7: System Operations
Security — CC8: Change Management
Security — CC9: Risk Mitigation
Availability — A1 (Optional)
Processing Integrity — PI1 (Optional)
Confidentiality — C1 (Optional)
Privacy — P1–P8 (Optional)
SOC 2 Audit Process
What is SOC 2 and who needs it?
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). Unlike regulations such as GDPR or HIPAA, SOC 2 is not a legal requirement — it is a voluntary standard. However, it has become the de facto security credential expected by enterprise customers before purchasing B2B software. SaaS companies, cloud infrastructure providers, data processors, and managed service providers are most frequently asked to demonstrate SOC 2 compliance. If your sales team is losing deals to "do you have a SOC 2 report?" questions, this checklist is your readiness roadmap.
SOC 2 is structured around Trust Services Criteria (TSC): Security (CC criteria, mandatory for all reports), Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P1–P8). Most companies start with Security only. Adding Availability is common for uptime-sensitive infrastructure services. Including all five criteria significantly increases audit scope and cost.
SOC 2 Type 1 vs Type 2 — which do you need?
A SOC 2 Type 1 report assesses whether your controls are suitably designed at a single point in time. It is faster to obtain (typically 2–4 months) and less expensive. A SOC 2 Type 2 report assesses whether your controls operated effectively over a period of time — typically 6 or 12 months. Enterprise customers and regulated industries almost always require Type 2. The typical path is: implement controls → get Type 1 report → operate for 6–12 months → get Type 2 report.
SOC 2 audits must be conducted by a licensed CPA firm. Costs typically range from $20,000 to $80,000+ depending on scope and auditor. Readiness assessments ($5,000–$15,000) are strongly recommended before the formal audit to identify gaps. Unlike PCI DSS, SOC 2 does not prescribe specific controls — it defines objectives, and you choose how to meet them. This means thorough documentation and evidence collection is critical: policies, logs, access reviews, and change records must all be demonstrable to the auditor.
How to use this SOC 2 readiness checklist
Start with the Security (CC) criteria — they are mandatory for every SOC 2 report. The most common gaps found in readiness assessments are: lack of formal quarterly access reviews (CC6.2), missing MFA enforcement (CC6.1), undocumented change management procedures (CC8.1), and absent vendor risk management (CC9.2). Address these first.
Each checklist item includes a reference to the relevant Trust Services Criterion. Document all evidence as you go — policies should be written and version-controlled, and operational controls should produce logs or records that can be provided to auditors. If you also handle EU data, review our GDPR checklist; if you process payments, see the PCI DSS checklist. Download the PDF to share your readiness status with your CPA firm or internal stakeholders.