Toolkit
SOC 2 readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Service organisations — cloud/SaaS providers, data centres, managed IT and other providers handling sensitive data for clients — whose customers want independent assurance over their controls.
Scope
- Covers a defined system: the infrastructure, software, people, procedures and data used to deliver specific services
- Security (the common criteria) is always included; Availability, Processing Integrity, Confidentiality and Privacy are added only where relevant
- Market-driven, not legally required — customers write it into contracts and vendor-risk programmes
Key requirements
- Define the services and commitments actually made to customers, in contracts, SLAs and marketing
- Choose which Trust Services Criteria categories apply beyond Security
- Decide how to handle subservice organisations: carve-out or inclusive method
- Run a readiness assessment and fix gaps before the examination
- Operate the controls for the whole review period if pursuing a Type 2 report — design alone only supports a Type 1
- Engage an independent, licensed CPA firm — advisory support and the examination itself must come from separate, independent parties
- Prepare the system description under the AICPA's description criteria (DC 200)
Evidence to gather
- Governance records: policies, risk assessments, management oversight
- Access records: provisioning, periodic reviews, termination evidence
- Change records: approvals, testing, development/production segregation
- Monitoring alerts, incident tickets, vulnerability scans and remediation
- Subservice organisation due diligence and their own reports
- HR records: background checks, training completion, policy acknowledgements
Common gaps
- Saying 'we passed SOC 2' — there's no pass mark, only an opinion, which can note exceptions
- Treating points of focus as a mandatory checklist instead of design guidance
- A clean report that carves out the hosting provider, which says nothing about that provider's own controls
- Forgetting complementary user entity controls that customers are responsible for operating themselves
- Evidence gaps mid-period, like one missed quarterly access review, becoming a reported exception
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full SOC 2 guide, the official text, or a qualified adviser.