SOC 2 Readiness Checklist

Use this to organize evidence and activities for SOC 2 Type 1/2.

Governance & Policies

• Information Security Policy reviewed annually
• Access Control, Vendor Risk, Vulnerability Management Policies
• Roles and responsibilities defined (RACI)

Risk Management

• Documented risk assessment (inherent, residual, owner, due date)
• Centralized risk register and review cadence
• Executive/Board summary of top risks

Access Management

• SSO enforced and MFA for privileged accounts
• Quarterly access reviews for critical systems
• Joiner/Mover/Leaver workflow with timely deprovisioning

Change Management / SDLC

• Code reviews and CI/CD checks
• Security testing integrated (SAST/DAST/dependency)
• Separation of duties for prod changes

Security Operations

• Vulnerability scans; SLA-based remediation
• Central logging/monitoring; alert triage runbooks
• Annual pen test and tracked remediation

Business Continuity

• Backups tested
• DR plan with RTO/RPO and test results

Privacy & Data Protection

• Data inventory and retention schedule
• Encryption in transit/at rest; key management
• DPIAs/PIAs where applicable

Evidence Tips

Exportable proofs: policy PDFs, screenshots, tickets, reports, minutes, pen test results.