How to use: check each box you can honestly answer "yes" to. Every unchecked item is a gap an auditor or enterprise buyer will likely find first. This is the lite version; the full SOC 2 Readiness Pack ($147) includes the complete checklist mapped to every criterion plus 8 policy templates.
🔐 Security / Common Criteria (the core)
The bulk of SOC 2 lives here.
🟢 Availability
🔵 Confidentiality
🟣 Processing Integrity
🟠 Privacy
📊 Score yourself
- 0–3 unchecked — Strong start. Tighten the gaps and you're close to readiness.
- 4–8 unchecked — Typical for a growing SMB. A focused 60–90 days closes most of it.
- 9+ unchecked — You'd stall a security questionnaire today. Start with policies + the risk register.
What "ready" actually means: readiness = your documentation and controls are in place and operating. A licensed CPA firm performs the actual SOC 2 audit — anyone promising "instant SOC 2 certification" is selling you a problem.
Do it yourself
The full SOC 2 Readiness Pack — complete checklist + 8 policy templates.
Get the Pack — $147 →Want a second opinion?
Free 30-min Risk Snapshot — 15 questions, a real score, no pitch.
Book the Risk Snapshot →