SOC 2 guide
SOC 2 readiness review checklist: every criterion, the evidence, and the gaps that fail examinations
Tick through every Trust Services Criterion before the CPA firm arrives: 100 checks across the nine common-criteria series and the four optional categories, the evidence each one needs, the gaps that most often become exceptions, and a realistic timeline to your report.
Key points
- SOC 2 examinations use the AICPA's 2017 Trust Services Criteria, read with the points of focus revised in 2022. Security, expressed in 33 common criteria, is in every report; availability, processing integrity, confidentiality and privacy join it when your client commitments call for them.
- This checklist turns all 61 criteria into 100 checks, each with the evidence a CPA firm usually asks for. Tick an item only when that evidence exists, dated and retrievable, not when the control is still planned.
- Checks labelled as a common exception count double in the weighted score. They rely on a routine task happening on time throughout the period: removing leavers, reviewing access, approving changes, fixing vulnerabilities, reading vendor reports.
- A first Type 2 report typically arrives nine to fifteen months after kick-off, because controls must operate for a period before they can be tested. Sterling prepares you; the CPA firm examines and issues the report.
How SOC 2 is structured, and why Security is always in scope
The Trust Services Criteria are set by the AICPA's Assurance Services Executive Committee and fall into five categories. The criteria themselves date from 2017; the 2022 revision changed only the points of focus, the illustrative characteristics that help management and the auditor judge whether a criterion is met. Points of focus guide judgement. They are not a list of mandatory controls, and not every one fits every organisation.
Security is the one category that cannot be left out. Its criteria are called common criteria because they underpin whichever other categories you add: CC1 to CC5 mirror the five components of the COSO internal control framework, and CC6 to CC9 turn to access, operations, change and risk mitigation. The other four categories are selected, but not freely. They should follow what you have promised clients in contracts, service descriptions and security questionnaires, so a client relying on your uptime will expect availability, and one sending you sensitive files will expect confidentiality.
- Security: 33 common criteria in nine series, CC1 to CC9.
- Availability: 3 criteria, A1.1 to A1.3.
- Processing integrity: 5 criteria, PI1.1 to PI1.5.
- Confidentiality: 2 criteria, C1.1 and C1.2.
- Privacy: 18 criteria in eight groups, P1 to P8.
The CPA firm does not test the criteria as such. It tests the controls your system description says meet them, which is why readiness is about choosing controls that fit your system and proving that they run.
How to use this checklist
Start with the common criteria, then work only through the additional categories you plan to include. Tick an item when you can produce the evidence described beneath it, dated within the period that matters; an approved policy that nobody follows yet is not a tick. Each item names the criterion it mainly supports, so the ticked list becomes the first draft of your control matrix.
Items labelled as a common exception carry double weight in the progress score, which measures effort rather than predicting an opinion. Ticks are saved in this browser only: use Print or save as PDF to share a snapshot, and Reset when you start a new period.
CC1 Control environment
CC1.1 to CC1.5 look at integrity, oversight, structure, competence and accountability. The CPA firm tests them with documents and samples of people, so gaps show up early in fieldwork.
CC2 Communication and information
CC2.1 to CC2.3 cover the information your controls rely on and how expectations reach staff, clients and vendors. The system description, which the CPA firm also reports on, is prepared alongside them.
CC3 Risk assessment
CC3.1 to CC3.4 need objectives clear enough to assess risk against, a risk assessment that includes fraud, and a way to notice changes that alter the picture. A register written once for the readiness project will not carry a Type 2.
CC4 Monitoring activities
CC4.1 and CC4.2 ask how you know the controls work between examinations, and what happens when they do not. Monitoring has to be planned, performed and followed through.
CC5 Control activities
CC5.1 to CC5.3 link each risk to the control that answers it, extend that to technology, and require policies that people actually follow. A control matrix is the working tool here.
CC6 Logical and physical access controls
CC6.1 to CC6.8 cover who can reach your systems and data, how access is granted and removed, and how networks, devices and media are protected. With eight criteria it is the largest series, and much of its evidence comes from samples of joiners, leavers and reviews.
CC7 System operations
CC7.1 to CC7.5 follow a problem from detection to recovery: configuration drift and vulnerabilities, monitoring for anomalies, judging whether an event is an incident, responding, and restoring service.
CC8 Change management
CC8.1 is a single criterion, but it is tested against every change made in the period. It covers infrastructure, data, software and procedures, so configuration and database changes count as much as code.
CC9 Risk mitigation
CC9.1 and CC9.2 deal with the risks you cannot remove: disruption to the business and dependence on vendors and partners. Your subservice organisations' own SOC reports are reviewed here.
Availability
A1.1 to A1.3 apply when availability is in scope. They test whether capacity, environmental protection, backup and recovery are managed well enough to meet the uptime and recovery commitments you have made.
Processing integrity
PI1.1 to PI1.5 matter when clients rely on you to process transactions or data correctly: payroll, payments, claims, calculations or reports. Each stage, from definitions to stored output, needs its own controls.
Confidentiality
C1.1 and C1.2 cover information you have committed to keep confidential, whether client data, intellectual property or business plans. Testing follows that information from identification to disposal.
Privacy
P1 to P8 hold 18 criteria and apply when privacy is in scope. Each is tested against what your privacy notice and commitments say you do with personal information.
The evidence a CPA firm asks for, by control area
Evidence requests arrive as a list, usually before fieldwork starts, and in a Type 2 most of them are samples drawn from populations: every joiner, every leaver, every change in the period. Check that each item below exists before the list arrives.
| Control area | Criteria | Evidence usually requested |
|---|---|---|
| Governance and oversight | CC1.2, CC1.3 | Oversight meeting minutes, the organisation chart, the security role's charter or appointment |
| People and HR security | CC1.1, CC1.4, CC1.5, CC2.2 | Background checks, signed code and policy acknowledgements, training completion and performance reviews for sampled staff |
| Risk management | CC3.1 to CC3.4 | The dated risk assessment, the register with owners and treatments, the fraud risk review, reviews triggered by change |
| Monitoring | CC4.1, CC4.2 | The control calendar, internal audit or assessment reports, the penetration test report, the deficiency log with closure dates |
| Identity and access | CC6.1 to CC6.3 | User listings and how they were produced, joiner and leaver tickets matched to HR records, access review sign-offs, MFA settings |
| Networks and endpoints | CC6.6 to CC6.8 | Firewall or security group rules, encryption settings, endpoint protection and device compliance reports |
| Operations and incidents | CC7.1 to CC7.5 | Scan reports with remediation tickets, alert rules and triage records, the incident register, the tabletop exercise record |
| Change management | CC8.1 | A system-generated list of production changes, and for a sample, tickets, approvals, test results and emergency change reviews |
| Vendors and subservice organisations | CC9.2 | The vendor inventory, risk assessments, contracts and your review of each subservice organisation's SOC report |
| Continuity and recovery | CC9.1, A1.1 to A1.3 | Continuity and recovery plans, capacity reports, backup logs and dated restore or failover tests |
| Processing integrity | PI1.1 to PI1.5 | Processing specifications, validation and error logs, output reconciliations |
| Confidentiality and privacy | C1.1, C1.2, P1 to P8 | Classification and retention schedules, disposal records, the privacy notice, consent records, request and breach registers |
Gaps organisations miss, and why they fail the examination
A SOC 2 report has no pass mark. Failing, in practice, means a report full of exceptions, or a qualified opinion when controls did not operate or the description misstates the system. Nearly every gap below is about consistency over time, not missing documents.
| The gap | Why it fails the examination |
|---|---|
| Leavers keep access for days after their last day | The CPA firm compares the HR leavers list with deactivation dates, and each removal later than your policy allows is an exception. |
| Access reviews are signed but change nothing | A review that never finds anything, or finds problems nobody fixes, does not show the control working; the firm looks for the removals that followed. |
| Emergency changes never get retrospective approval | Hotfixes sit in the same population as every other production change, so an unapproved one is sampled like any other. |
| Policy timeframes are stricter than practice | Testing is against what your policy says. A seven-day patching rule met in thirty days is an exception, even if thirty days would have been reasonable. |
| Joiners are trained or screened late | Sampled joiners are checked against their start and first-access dates, and late completion counts against you. |
| The description shows the intended system | Tools, locations or subservice organisations that differ from reality make the description inaccurate, and the opinion covers the description as well as the controls. |
| Nobody reads the cloud provider's SOC report | That report lists controls its customers must operate. Unread, they go unoperated, and the exceptions it discloses are never assessed. |
| Backups run, but restores are never tested | Recovery testing is a criterion in its own right under availability; a successful backup job does not prove data can be recovered. |
| The risk assessment was a one-off for the project | Without a refresh, or a review after significant change, nothing shows the risk process operated during the period. |
| Alerts fire, but triage leaves no trace | Monitoring is tested on what happened to the alerts. Without tickets or notes, there is no evidence anyone responded. |
| Controls depend on one person | When the security lead is on leave or leaves, reviews and approvals stop, and those weeks show up in the samples. |
| Contracts promise more than the controls deliver | Controls are judged against your service commitments, so a promise of next-day breach notification or encryption everywhere sets the bar the evidence must clear. |
A realistic timeline from checklist to report
Time, more than writing, fixes the calendar: a Type 2 needs controls that have operated for a period, and nothing shortens that period once it has begun. The ranges below are for planning, not promises; where you land depends on how much of this checklist is already ticked.
| Phase | Typical range | What decides where you land |
|---|---|---|
| Readiness: scope and gap analysis | 2 to 6 weeks | Access to people and systems, the categories in scope, and any earlier questionnaires or audits |
| Remediation and control design | 1 to 4 months | Engineering and tooling changes, policy approvals, training and the time control owners can give |
| Examination period (Type 2) | Typically 6 to 12 months | The period agreed with the CPA firm; a shorter first period is sometimes agreed to meet a client deadline |
| Fieldwork | 2 to 6 weeks after the period ends | How quickly evidence requests are answered and how many exceptions need discussion |
| Report | 2 to 6 weeks after fieldwork | Finalising the description, management's assertion and responses to any exceptions |
A Type 1 report, on the design of controls as at a date, is realistic three to six months from kick-off. Taken end to end, with a first period at the shorter end of the range, a first Type 2 report typically arrives nine to fifteen months after kick-off. Treat any offer of a report in days with suspicion: a CPA firm cannot give an opinion on controls that have not yet operated.
How Sterling prepares you
From this checklist to a report your clients accept
Sterling's expert and experienced consultants begin with a gap analysis against every criterion in scope, then design the controls with the people who will run them, so they fit your system rather than a template. Evidence is collected in Effivity, included with the engagement at no additional cost, from the first workshop, and a readiness assessment tests each control the way the CPA firm will before the period begins. We ensure a successful SOC 2 examination for our clients. Sterling does not issue the report; the CPA firm examines and opines.
Book a free discovery callSOC 2 readiness checklist: questions buyers ask
Do we need to complete every section of this checklist?
Only the sections for the categories in your scope. The common criteria, CC1 to CC9, apply to every SOC 2 examination, so those sections always matter. Availability, processing integrity, confidentiality and privacy apply only if you include them, and that choice should follow your commitments to clients.
If every item is ticked, are we ready for the examination?
Not necessarily. A tick records that a control and its evidence exist; readiness means the control has run consistently and its evidence would survive sampling. That is why Sterling tests a sample of each control, as the CPA firm will, before the examination period starts.
Are the points of focus requirements we must meet one by one?
No. They illustrate characteristics that help management and the auditor judge whether a criterion is met, and not all of them apply to every organisation. The CPA firm evaluates your controls against the criteria. Reading the relevant points of focus is still the quickest way to find where a control is thin.
Does our cloud provider's SOC 2 report cover the physical and infrastructure items?
It covers the provider's controls, not yours. Cloud providers are usually treated as subservice organisations under the carve-out method, which leaves their controls out of your report but expects you to monitor them. You still operate the complementary user entity controls their report lists, and you still own everything configured inside your cloud accounts.
Can one control satisfy more than one criterion?
Yes, and a lean control set depends on it. A quarterly access review supports provisioning, removal and least privilege, and a well-run change process supports processing integrity as well as change management. Mapping each control to every criterion it serves keeps the set smaller and evidence requests easier to answer.
How often should we repeat this review after the first report?
Once a year before each new examination period, and again after any significant change to the system, the team or the vendors you rely on. Between reviews, check the items labelled as common exceptions monthly, because each depends on a task recurring on time.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 bridge letters, report validity and the annual cycle
- SOC 2 cost: what moves the price
- SOC 2 for managed service providers and data centres
- SOC 2 in the Netherlands and Europe
- SOC 2 policies and evidence: what you need and what you do not
- How to read a SOC 2 report
- SOC 2 for SaaS and technology
- SOC 2 scope
- The SOC 2 system description: what to write and what to leave out
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice