SOC 2 Readiness Assessment

A pre-audit review that maps your existing controls to the Trust Services Criteria, identifies the gaps an auditor would flag, and delivers a prioritized roadmap for closing them before your audit period begins.

It is not an audit and it produces no opinion. It tells you what would fail, and in what order to fix it, while you still have time to act.

In practice they describe the same engagement, and we use the terms interchangeably. A gap assessment names the output, which is the list of gaps between your controls today and what the audit will test. A readiness assessment names the purpose, which is getting you ready for the examination.

Either way the work covers scope definition, control mapping, evidence review and a remediation roadmap. If you want to see the kind of thing that comes back, we wrote up the 10 gaps we find most often.

The assessment itself typically runs 4 to 8 weeks.

Remediation is the variable part. Most teams plan on 1 to 6 months between the readiness readout and the start of their audit period, depending on how many gaps came back and how quickly the team can close them.

A prioritized control gap listing with specific remediation guidance for each item, categorized by severity so you know what has to be fixed before the audit and what is lower risk.

It also includes a recommended start date for your observation period and a readout session with your team to walk through the findings and answer questions.

It is not required. It is worth doing if this is your first SOC 2, if your environment has changed materially since the last one, or if you are not confident your controls would hold up under testing. If your controls are mature and already evidenced, you can go straight into the examination.

Gaps found during fieldwork cost far more time and money than gaps found before it, which is the whole argument for doing this first. Our step-by-step guide to preparing for a SOC 2 audit walks through what the work looks like if you want to attempt a first pass yourself.

Yes. The work is the same shape, but instead of mapping controls to the Trust Services Criteria we map them to the control objectives you define for the report, and scope centers on the processes that affect your customers' financial reporting.

If you are not sure whether your customers are asking for SOC 1 or SOC 2, that is worth a short conversation before scoping anything. Reach out and we'll point you in the right direction →

You can start with one, and it is free: our interactive SOC 2 checklist builds a personalized gap list from 23 questions about your environment.

A self-assessment tells you where you think you stand. A readiness assessment tells you where an auditor would say you stand, with the scoping decisions and remediation roadmap a checklist cannot make for you.

It depends on the size of your system boundary, the Trust Services Categories in scope, and how mature your evidence already is.

Most teams engage readiness packaged with the Type 1 and Type 2 examinations in one fixed fee quoted before work begins, rather than as a standalone line item. Our pricing page and its calculator show how the full engagement is scoped.

A SOC 2 assessment is a review of an organization's controls against the AICPA Trust Services Criteria. The term gets used two ways: a readiness assessment (or gap assessment) is the pre-audit review a company runs to find what would fail, and the SOC 2 examination is the attestation engagement in which a licensed CPA firm tests the controls and issues an opinion.

Only the examination produces a SOC 2 report. The readiness assessment tells you whether you are ready for it, and what to fix first.

How hard SOC 2 compliance is depends on how far your current practices sit from the criteria. Teams that already run MFA, peer-reviewed changes, vendor reviews, and a written risk assessment mostly need to document and evidence what they do; teams starting from scratch spend most of the effort building those routines.

Plan for a real time commitment from engineering and leadership during readiness (the readiness work alone typically takes at least 100 hours of your team's time), then a lighter steady state once evidence collection is routine. The framework is flexible about how you meet each criterion, which is what keeps it manageable: it asks whether your controls address the criteria, not whether you bought a specific tool.

A SOC 2 Type 2 compliance checklist is the list of controls, policies, and evidence a company needs to have operating across an observation period, not just designed at a point in time. It covers the same areas as a Type 1 checklist (governance, access, change management, risk and vendor management, monitoring, incident response, and any Availability, Confidentiality, Processing Integrity, or Privacy controls in scope) and adds the operating proof: dated access reviews, completed change tickets, tested backups, closed incidents, and training records collected throughout the period.

The checklist on this page covers the design side; the interactive SOC 2 checklist turns it into a personalized gap list.