A SOC 2 readiness assessment is a structured review done before the formal examination. It finds control gaps, sets priorities, and cuts avoidable surprises.
This guide covers what the assessment is, what it reviews, how to complete one step by step, how to read the findings, and when outside help makes sense.
Key Takeaways
- A readiness assessment is a diagnostic, not a SOC 2 report or certification.
- Clear scope, well-designed controls, consistent execution, and reliable evidence drive success.
- Type 2 needs proof that controls worked throughout a review period, so start early.
- The end product is a remediation plan with owners and target dates.
What Is a SOC 2 Readiness Assessment?
A readiness assessment evaluates your systems, policies, procedures, controls, and evidence against the AICPA Trust Services Criteria before an auditor does. It shows what is in place, what is partly done, what is missing, and what needs work.
Readiness vs. a SOC 2 report
The AICPA defines a SOC 2 examination as an assessment of whether your system description meets the description criteria and whether controls are suitably designed. For Type 2, it also covers whether those controls operate effectively. An independent CPA issues an opinion on that.
Readiness is different. Schellman's readiness guidance describes it as an internal gap deliverable with no opinion. Gaps are yours to fix.
SOC 2 is also an attestation, not a certification. Avoid calling your company "SOC 2 certified." Say you have a SOC 2 Type 1 or Type 2 report.
Why organizations do it
- Customer security reviews and questionnaires
- Enterprise deals waiting on a SOC 2 report
- Preparing for a first examination
- Giving leadership and the board a clear picture of risk
What the Five SOC 2 Trust Services Criteria Mean
SOC 2 rests on five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is required on every examination and forms the common baseline (the common criteria, or CC series). You add the other four based on your services, customer commitments, and risks.
What each category covers:
- Security: Protects systems against unauthorized access and underpins the other categories through the common criteria
- Availability: Systems remain available for operation and use as committed
- Processing Integrity: Processing is complete, valid, accurate, timely, and authorized
- Confidentiality: Information designated confidential is protected as agreed
- Privacy: Personal information is collected, used, retained, disclosed, and disposed of per commitments and criteria
| Category | Criteria |
|---|---|
| Security | Common criteria only |
| Availability | Common criteria plus A series |
| Processing Integrity | Common criteria plus PI series |
| Confidentiality | Common criteria plus C series |
| Privacy | Common criteria plus P series |
Don't confuse these with the five COSO components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The criteria align with COSO's 2013 principles, and CC1 through CC5 reflect those components. CC6 through CC9 (access, system operations, change management, risk mitigation) supplement them.
Check current AICPA materials when scoping. The current standard is the 2017 Trust Services Criteria with revised points of focus (2022). The 2022 update changed guidance, not the underlying criteria, and points of focus are not a mandatory control checklist.
What Does a SOC 2 Readiness Assessment Review?
Scope and the system description
Scope comes first: the services, systems, locations, infrastructure, data types, environments, and third parties behind the service being examined.
The system description is a central artifact. Under the AICPA's DC 200 criteria, it explains:
- Services provided and principal commitments
- Infrastructure, software, people, procedures, and data
- Significant incidents
- Applicable criteria and related controls
- Subservice organizations and user entity controls
Subservice providers can be handled by the inclusive method (included in scope) or carve-out method (excluded, but disclosed along with your monitoring of them).
Control domains
A Common Criteria review typically covers:
- Governance and tone at the top
- Risk assessment
- Security policies and personnel security
- Logical and physical access
- Change management
- System operations, vulnerability management, and incident response
- Monitoring
Selecting Availability, Confidentiality, Processing Integrity, or Privacy adds further control areas.
Design vs. operating effectiveness
A control must be designed to address a risk, and the responsible person must perform it consistently. A well-written policy that nobody follows fails the second test.
Evidence
Auditors evaluate evidence, not verbal assurances. Expect to show:
- Access reviews and approvals
- Tickets and change records
- Training records
- Risk assessments and incident records
- Monitoring output and vulnerability remediation
- Backup or recovery tests
- Vendor reviews and management sign-offs
Each item should show who did what, when, what was reviewed, what exceptions arose, and how they were resolved.
SOC 2 Readiness Assessment Checklist: A Step-by-Step Process
1. Define objectives and scope
- Document why you need SOC 2, which customers or contracts require it, and which services and criteria apply.
- Choose Type 1 or Type 2 and record the examination date or reporting period.
- List in-scope systems, cloud environments, applications, data flows, people, facilities, and vendors.
2. Inventory and map current controls
- Collect policies, procedures, risk registers, architecture diagrams, prior assessments, penetration test results, and monitoring records.
- Map each control to criteria, with an owner, frequency, evidence, and escalation path.
- Mark each as implemented, partial, undocumented, inconsistent, or not applicable (with a reason).
3. Evaluate control design
Test whether each control addresses a defined risk and names the role, action, frequency, approval path, and retained evidence.
Watch for vague wording. "Access is reviewed regularly" should become something like: "The IT manager reviews all production access quarterly, records exceptions, and files the signed review in the ticketing system."
Also check that policies match real configurations and workflows, not an idealized process.
4. Review operating effectiveness and evidence
- Sample evidence from the relevant period.
- Verify timestamps, approvals, reviewer identity, population coverage, and exceptions.
- Flag gaps from manual processes, inconsistent naming, missing approvals, or unclear retention.
5. Prioritize findings and build a remediation plan
Rank findings by risk, control significance, customer impact, dependencies, and effort. Give every item an owner and target date. Separate quick documentation fixes from larger process, technology, or staffing changes.
Define what evidence will prove each gap is closed.
6. Validate before the examination
- Recheck the system description, scope, control matrix, and evidence repository.
- Run walkthroughs so control owners can explain controls and pull evidence without a scramble.
- Confirm the organization can sustain controls for the whole examination period.
SOC 2 Assessment Types and Timing
Self-assessment vs. formal readiness assessment
A self-assessment uses your own staff, control matrix, and evidence review. It's cheaper but can miss assumptions your team can't see. A third-party assessment adds an independent view.
Before hiring one, confirm:
- Provider role and deliverables
- Remediation boundaries
- Independence considerations
Under AICPA independence rules, management must keep responsibility for controls. A CPA firm that later performs your attestation can advise but cannot design, implement, or monitor your controls.
Type 1 vs. Type 2
Type 1 covers design and implementation at a point in time. Type 2 adds operating effectiveness over a period. Type 1 is not a required stepping stone, and many organizations go straight to Type 2.
Schellman describes Type 2 periods of 3 to 12 months, with three months common for first reports. The AICPA guide sets no minimum period, so confirm with your auditor. If you're targeting Type 2, begin collecting evidence well before testing starts. Controls implemented the week before fieldwork are hard to defend.
When to begin
Start early enough to define scope, fix gaps, standardize evidence, train owners, and build an operating rhythm. Timing depends on factors such as:
- System complexity and scope
- Control maturity
- Number of Trust Services Criteria in scope
- Third-party dependencies
- Available staff
For duration and cost, get a written quote from an auditor or readiness provider rather than relying on generic industry averages.
What to Do After the Assessment
Treat findings as a program improvement plan
Sort results into high-risk deficiencies, missing evidence, documentation mismatches, scope issues, and lower-priority improvements. Present them to leadership in business terms: customer commitments, resilience, regulatory exposure, and resources required.
Track everything in one register with owners, due dates, status, dependencies, completion evidence, and sign-off on residual risk. The Trust Services Criteria expect the same: CC4.2 states that "management tracks whether deficiencies are remedied on a timely basis."
Build controls that last
Audit-only paperwork collapses in a Type 2 period. Write policies that reflect real workflows, and make sure owners understand why each activity matters.
Where in scope, run recurring:
- Access reviews
- Security training
- Vendor reviews
- Incident exercises
- Risk assessments
- Vulnerability remediation and change approvals
- Management monitoring
Collect evidence continuously and review internally on a schedule, so the next examination and the next customer questionnaire are routine.
Select the right readiness support
Evaluate providers on:
- SOC 2 and GRC experience
- Grasp of your technology environment
- Evidence method and communication style
- Remediation boundaries
- Fit with your existing tools
DeepSeas offers practitioner-led GRC and audit-readiness support, including:
- Gap assessments
- Guided SOC 2 documentation development
- Control implementation guidance
- Evidence organization
- A readiness review before the assessor arrives
- Post-audit remediation consulting
Its specialists include ISO Lead Auditor-certified practitioners, and engagements range from platform-only to fully managed GRC.
Be clear on the provider's role: readiness support, remediation guidance, or formal attestation. Hire an independent, qualified CPA firm for the SOC 2 report itself.
Frequently Asked Questions
What is a SOC 2 compliance checklist?
It's a list of scope decisions, criteria, control domains, policies, evidence, owners, remediation tasks, and final validation steps. It supports preparation but doesn't replace auditor judgment.
How hard is SOC 2 compliance?
Difficulty depends on scope, control maturity, evidence quality, system complexity, third-party dependencies, and staffing. Early planning and consistent operation make it far more manageable.
What does SOC 2 compliance mean?
It means an independent auditor examined your controls against selected Trust Services Criteria and issued a report with an opinion. SOC 2 is an attestation, not a certification.
What are the 5 principles of SOC 2?
Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the baseline; the others are added based on your scope and commitments.
What is the difference between a SOC 2 readiness assessment and a SOC 2 audit?
Readiness finds gaps so you can remediate beforehand. The audit evaluates controls and produces an independent SOC 2 report.
How long does a SOC 2 readiness assessment take?
It varies with scope, complexity, evidence availability, control maturity, and stakeholder availability. Ask your provider for a project plan with defined phases and milestones.
