SOC 2 readiness checklist: 26 things to have in place.

The checklist

Scope and governance

• Systems, data and teams in scope are written down
• Trust Services Criteria chosen beyond Security
• A named owner for the security programme
• Leadership has approved the information security policy
• A risk assessment is done and recorded

Policies

• Information security, acceptable use, access control policies
• Incident response, business continuity and disaster recovery plans
• Change management, vendor management and data retention policies
• Every policy approved, versioned and acknowledged by staff

People

• Background checks for new hires where lawful
• Security awareness training on hire and yearly
• Joiner, mover and leaver checklists followed and recorded
• Confidentiality agreements signed

Access

• Multi-factor authentication on every critical system
• Access granted by role and approved
• Quarterly access reviews, recorded
• Leavers’ access removed promptly, with evidence

Systems and change

• Production changes reviewed and approved by someone other than the author
• Vulnerability scanning and patching with timelines
• Logging and monitoring with alerts reviewed
• Encryption in transit and at rest
• Backups taken and a restore tested

Vendors and incidents

• A vendor register with risk tiers
• SOC 2 reports or assessments for critical vendors
• Agreements (DPA, BAA, NDA) on file with dates
• Incident log, and an incident response exercise held

What to do with the gaps

Rank the gaps by risk and by what your auditor will sample first: access, change management and vendor management are common starting points. Then assign an owner and a date to each. We can run this assessment with you.