SOC 2 Readiness Assessment and Checklist

Tilt-shift miniature of two people working through a readiness checklist on a whiteboard — A readiness assessment tests controls the way the auditor will, before the report period starts.

Most SOC 2 problems are visible months before the auditor arrives. A readiness assessment finds them while they are still cheap to fix: a control that exists on paper but leaves no evidence, an access review nobody ran, a change that went to production without approval. This article sets out what a readiness assessment covers and the checklist we work through.

Short answer

A SOC 2 readiness assessment tests your controls against the Trust Services Criteria in the same way the CPA firm will, before the report period starts. It confirms the scope, checks that each control is designed properly and produces evidence, and gives a prioritised list of gaps to close. It is the step that turns a Type II from a gamble into a formality.

What a readiness assessment covers

Scope. The service, systems, people, locations and subservice providers in scope, and which criteria apply. Security is always in.
Control design. Each control mapped to the criteria, with a clear owner and frequency.
Evidence. For each control, what the auditor will sample and whether it exists: tickets, logs, approvals, review records.
System description. A draft of the description of the system that will sit in the report.
Gap plan. What to fix, in what order, and when the observation period can start.

The SOC 2 readiness checklist

Area	What the auditor will look for
Governance and oversight	Policies approved and reviewed, defined security roles, management oversight, and a code of conduct acknowledged by staff.
Risk assessment	A documented risk assessment, including fraud risk and vendor risk, reviewed at least annually.
People	Background checks where appropriate, onboarding and offboarding records, and security awareness training completed.
Access control	Unique accounts, MFA, least privilege, timely removal of leavers, and periodic access reviews with evidence.
Change management	Changes tracked, reviewed and approved before release, with separation between development and production.
Operations and monitoring	Logging and alerting, vulnerability scanning, patching, and a recent penetration test with findings tracked.
Incident response	A documented plan, a record of incidents and how they were handled, and a test of the plan.
Data protection	Encryption in transit and at rest, backups, and tested restores.
Vendor management	A list of key vendors, due diligence on each, and review of their own SOC 2 reports. See how to review a SOC 2 report.
Availability (if in scope)	Capacity monitoring, business continuity and disaster recovery plans, and a recovery test.

The gaps we find most often

Controls that run but leave no trace. Access reviews done in a conversation, with nothing to show the auditor.
Leavers with live accounts. Especially in SaaS tools outside the central identity provider.
Changes without approvals. Hotfixes pushed straight to production.
Vendor reviews that never happen. The policy says suppliers are assessed; nobody has read the cloud provider’s report.
An untested incident plan.

Most of these look familiar to anyone who has run an ISO 27001 project, because they are the same gaps. Our ISO 27001 gap analysis article covers how that side of the assessment works, and SOC 2 cost in Australia covers what readiness adds to the budget.

How Streamline helps

We run SOC 2 readiness assessments with a Lead Auditor, so controls are tested the way an auditor tests them. We are independent of the CPA firm that issues the report, so we prepare you properly rather than marking our own homework, and we usually build on an ISO 27001 foundation so the same work supports both. Read about our SOC 2 readiness and advisory or talk to us about SOC 2.

Frequently asked questions

What is a SOC 2 readiness assessment?

A rehearsal of the audit. The controls are tested the way the CPA firm will test them, so gaps can be fixed before the report period starts. It is not a SOC 2 report and is not shared with customers.

Who should do the readiness assessment?

Someone independent of the people who built the controls, with audit experience. Under independence rules, the CPA firm that issues the report should not also design and implement your controls, so readiness support usually comes from a separate adviser.

How long does readiness take?

For a business with ISO 27001 already in place, readiness and gap closure can take a few weeks. Starting from scratch, building the controls and the evidence routine usually takes a few months before the observation period can begin.

Can we skip Type I and go straight to Type II?

Yes. Type I is optional. It is useful when a customer wants something quickly, but many businesses go straight to a Type II once the readiness assessment shows the controls are working.

General guidance only. This article is general information, not legal, financial, safety or compliance advice, and it does not take account of your specific circumstances. Streamline ISO Consultants are ISO management-system consultants, not lawyers or licensed advisers. Standards, laws and regulator guidance change, and details were correct only at the time of writing. Always seek professional advice before acting. See our full Disclaimer.