SOC 2 Readiness Checklist

Next step: Write a one-page scope: the service, its production systems, the teams that run it and what is out of scope.

Next step: Start the description from your architecture diagram and your customer terms; list the controls you will rely on.

Next step: List every provider that runs part of the service and request their SOC 2 reports through their trust portals or account managers.

Next step: Write down what customers are responsible for (their own user accounts, their data, their devices) and put it in your documentation.

Next step: Ask two or three CPA firms for proposals that state the report type, the categories, the period and what evidence they will sample.

Next step: Pick a period start date after the last control is in place, and keep records from that day on.

Next step: Create a folder or tracker with one entry per control: what the evidence is, where it lives, who owns it and how often it is produced.

Next step: Publish a code of conduct and collect a signed or recorded acknowledgement at hiring and every year.

Next step: Put security on the leadership agenda at least once a year and keep the minutes.

Next step: Name a security owner, write the security responsibilities of key roles, and keep the organisation chart current.

Next step: Add background checks to hiring (where lawful) and keep training records per person.

Next step: Add security duties to performance reviews and write down the disciplinary process for policy breaches.

Next step: Create an inventory of systems in scope with owners, and diagrams of the network and data flows; review them every quarter.

Next step: Publish the policies where staff work and run awareness training at onboarding and every year, keeping completion records.

Next step: Publish a security contact, describe in your terms how customers are notified, and keep copies of notices you send.

Next step: Keep approved answers in one library with an owner and review date, and reuse them for every questionnaire.

Next step: Collect the security, availability and confidentiality promises from contracts and the website into one list.

Next step: Run a risk assessment: list assets, threats and vulnerabilities, rate likelihood and impact, choose treatments and owners.

Next step: Add fraud and insider scenarios to the risk register and link them to controls such as segregation of duties and logging.

Next step: Make a risk review part of approving major changes, and record it.

Next step: Schedule control checks (at least yearly), a penetration test and regular vulnerability scans, and keep the reports.

Next step: Track every finding with an owner and due date, and review open findings with leadership.

Next step: Build a control list from your risk assessment that maps each risk to the controls that treat it.

Next step: Describe how access, change, operations and backups are controlled for each platform in scope.

Next step: Write or update the policy set, have management approve it, and set an annual review.

Next step: List every production system, database and admin console, and put them behind single sign-on or managed accounts.

Next step: Turn on enforced MFA for the identity provider, cloud consoles, code hosting and VPN, and review exceptions.

Next step: Enable encryption at rest for every data store and backup, enforce TLS, and limit who can manage keys.

Next step: Use a ticket for every access request and a leaver checklist; compare the HR leaver list with each system’s accounts.

Next step: Define roles, then run access reviews: each manager confirms, changes or removes every account, and the changes are made and recorded.

Next step: Restrict server-room access to named people, keep visitor logs and review badge access every quarter.

Next step: Download the provider’s SOC 2 report, note its exceptions and the controls it expects from you, and keep that review.

Next step: Use certified wiping or destruction for retired devices and record each disposal against the asset register.

Next step: Review firewall rules for default deny, close admin ports to the internet, and route admin access through a VPN or bastion with MFA.

Next step: Set rules for exports and file sharing, block or control removable media on company devices, and log large exports.

Next step: Deploy managed endpoint protection on every company device and server, and restrict who can install software.

Next step: Scan production at least monthly, set fix timelines by severity, and track each finding to closure.

Next step: Send identity, cloud, server and application security logs to one place, keep them for a set period and alert on key events.

Next step: Write simple severity criteria and record each triage decision in a ticket.

Next step: Write an incident response plan with roles, contacts and steps, and run a tabletop exercise every year.

Next step: Hold a post-incident review for every significant incident and track its actions to completion.

Next step: Protect the main branch, require a reviewer and passing tests before merge, and record infrastructure changes.

Next step: Define an emergency change path with review within days, and separate production access from development.

Next step: Write continuity and recovery plans with recovery time and data loss targets, and review insurance cover for cyber incidents.

Next step: Keep a vendor list with criticality, assess new vendors before signing, and review critical vendors every year.

Next step: Set alerts on capacity metrics and review growth trends every quarter.

Next step: Automate backups to a separate location or account, protect them from deletion, and design for the uptime you promise.

Next step: Restore a backup to a test environment and run a recovery exercise every year; record time taken and problems found.

Next step: Adopt a classification scheme, label your main data stores and restrict confidential data to those who need it.

Next step: Set retention periods, delete data when they end or when a customer leaves, and keep a record of the deletion.

Next step: Document the inputs, processing rules and outputs of each in-scope service and share them with customers.

Next step: Validate inputs at every entry point and report rejected records.

Next step: Add reconciliations and job failure alerts, and record how each failure was resolved.

Next step: Check outputs before release, restrict who receives them, and track delivery times.

Next step: Protect stored inputs and outputs with access restrictions and integrity checks such as checksums or audit trails.

Next step: Publish a clear privacy notice and update it when your processing changes.

Next step: Record consent where you rely on it, and let people change their choices easily.

Next step: Review each form and data feed, and remove fields you do not need.

Next step: Identify sensitive data and obtain explicit consent wherever the law or your commitments require it.

Next step: Review new uses of personal information against the notice before they start.

Next step: Set a retention period for each type of personal information and automate deletion where you can.

Next step: Set up a request channel and log, and track every access or correction request to completion.

Next step: List every third party that receives personal information and put a data processing agreement in place with each.

Next step: Record authorised disclosures (to whom, what, when, why) so you can answer people’s requests.

Next step: Keep a breach register, add breach notification clauses to vendor contracts, and write the notification procedure.

Next step: Let people update their details and check key records for accuracy.

Next step: Publish a privacy contact, log every complaint and its resolution, and review privacy compliance every year.