SOC 2 Readiness Checklist.
Sixty items. Evidence-named.

Auditor-grade readiness, in 60 items.

• →60 line items grouped across CC1-CC9, Availability (A) and Confidentiality (C)
• →Each item names the evidence artefact and the owner role expected to produce it
• →CSV is column-named for direct import into Drata / Vanta / Secureframe / spreadsheet
• →PDF version is annotated with the typical CC7.1 pentest-evidence pitfalls
• →References AICPA Trust Services Criteria 2017 (as revised) without restating proprietary text

All eleven sections — 60 items total.

1. CC1

   Control Environment

   5 items

   Board charter, security org chart, code of conduct, background checks, written security policy with annual review evidence.

2. CC2

   Communication & Information

   5 items

   Internal security comms cadence, customer security commitments (in MSA / DPA), incident-comm runbook, vendor security disclosures, whistle-blower channel.

3. CC3

   Risk Assessment

   6 items

   Annual risk register, threat modelling per major release, change-risk classification, vendor risk register, fraud-risk consideration, business-impact analysis.

4. CC4

   Monitoring Activities

   5 items

   Continuous-control monitoring tooling, deviation alerting, internal audit cadence, management remediation tracker, audit committee escalation route.

5. CC5

   Control Activities

   5 items

   Documented control matrix, segregation of duties evidence, technology-general-controls inventory, baseline configuration standards, deployment policy.

6. CC6

   Logical & Physical Access

   9 items

   SSO + MFA enforcement, role inventory + access reviews, joiner-mover-leaver, privileged access management, secrets management, data-classification labels, device-management, key-management policy, physical access logs (or hosting attestation).

7. CC7

   System Operations

   9 items

   External pentest within audit window, retest letter, vulnerability scanning evidence, IDS/IPS or EDR coverage, log centralisation, log-retention policy, incident-response runbook + tabletop, on-call rota, post-incident review template.

8. CC8

   Change Management

   6 items

   Change-management policy, ticket-to-PR linkage, code review enforcement, automated test gates, separation between developer + deployer, emergency-change process.

9. CC9

   Risk Mitigation

   4 items

   Cyber-insurance policy, business continuity plan + test evidence, disaster recovery plan + test evidence, vendor SLA tracking.

10. A

    Availability criteria

    3 items

    Capacity-management evidence, backup + restore test evidence, RTO / RPO commitments documented and measured.

11. C

    Confidentiality criteria

    3 items

    Data classification scheme applied to repositories + stores, encryption-in-transit + at-rest evidence, secure-disposal procedure with audit log.

Use this checklist alongside.