SOC 2 compliance checklist: what to have in place before the auditor arrives

Availability, Confidentiality, Processing Integrity and Privacy each add their own criteria when you put them in scope.

• Information security policy, approved by leadership and reviewed yearly
• Acceptable use, access control, change management, incident response, vendor management, data classification and retention, business continuity policies
• An org chart and named owners for security
• Employees acknowledge the policies at hire and yearly
• A code of conduct, and a way to report concerns

• A risk register, reviewed at least yearly and after major changes
• Each risk with a likelihood, an impact, an owner and a treatment
• Vendor inventory, with security reviews for critical vendors and their SOC reports on file
• Business continuity and disaster recovery plans, tested

• Single sign-on where the apps support it, and multi-factor authentication everywhere
• Access granted by role, approved, and recorded in a ticket
• Quarterly access reviews of production systems and key apps, with sign-off
• Access removed promptly at offboarding, with a checklist that proves it
• Encryption at rest and in transit, and managed devices with disk encryption and screen lock
• Physical access controls, or your data center provider’s SOC report

• Centralized logging for production and identity systems, with alerts someone acts on
• Vulnerability scanning on a schedule, with fix timelines by severity
• A recent penetration test, if your auditor or buyers expect one (see is a pen test mandatory)
• Endpoint protection on every company device
• An incident response plan, a tabletop exercise each year, and records of real incidents

• Code changes reviewed by someone other than the author before production
• Branch protection that enforces the review
• Separate test and production environments
• Infrastructure changes tracked the same way, and emergency changes reviewed after the fact

• Background checks at hire, where local law allows
• Security awareness training at hire and yearly, with completion records
• Signed confidentiality agreements
• Job descriptions for security roles, and performance reviews that include them

• Availability: uptime commitments, capacity monitoring, backups restored on a schedule, and a disaster recovery test with results.
• Confidentiality: a list of the confidential data you hold, who may see it, how long you keep it and how it is destroyed.
• Processing Integrity: input checks, error handling and reconciliation for the processing customers rely on.
• Privacy: your privacy notice, consent, access and deletion requests, and how personal data is shared with vendors.

Each category adds criteria, controls and audit time. Add one only when a customer asks for it or your contracts promise it.

A control without evidence is a control the auditor cannot test. Before the period starts, check that each item above produces at least one of these, on a schedule:

• A ticket or approval record
• A system export or screenshot with a date
• A signed or acknowledged document
• A log or report generated by the tool itself

Then keep complete population lists of new hires, leavers, changes and incidents. Auditors sample from them, and an incomplete list is a finding on its own. Doing this from a spreadsheet is possible; SOC 2 without a GRC tool shows how. The order of the steps that follow is in the SOC 2 audit process.