SOC2 Readiness Checklist 2026: 65 Controls Across 10 Domains
Use this checklist to assess your organization's SOC2 readiness before engaging an auditor. Work through each domain, note gaps, and use the time-to-remediate estimates to build a realistic preparation timeline. Download the printable PDF with scoring rubric below.
This checklist covers all 10 SOC2 control domains: Access Control, Change Management, Risk Assessment, Monitoring & Detection, Incident Response, Vendor Management, Business Continuity, Data Handling, Security Training, and Physical Security. Each item maps to a specific AICPA Trust Services Criteria reference. Items marked as gaps before your audit start are findings your auditor will likely identify — address them first.
Download the full printable PDF checklist
Includes scoring rubric (Ready / Partial / Not Started) and time-to-remediate estimates for each gap. Printable format for internal use or sharing with your auditor during kickoff.
Access Control
Change Management
Risk Assessment
Monitoring & Detection
Incident Response
Vendor Management
Business Continuity / Availability
Data Classification & Handling
Security Awareness Training
Physical Security
How to Estimate Your Readiness Score
Count your unchecked items in each domain. Use the table below to estimate total remediation hours. This gives you a realistic preparation timeline before contacting auditors.
| Domain | Controls | Hours to remediate all gaps | Typical priority |
|---|---|---|---|
| Access Control | 8 | 40 hrs | Critical |
| Change Management | 7 | 24 hrs | Critical |
| Risk Assessment | 6 | 20 hrs | High |
| Monitoring & Detection | 8 | 32 hrs | High |
| Incident Response | 6 | 16 hrs | High |
| Vendor Management | 6 | 20 hrs | Medium |
| Business Continuity | 7 | 28 hrs | Medium |
| Data Classification & Handling | 7 | 24 hrs | High |
| Security Awareness Training | 6 | 12 hrs | Medium |
| Physical Security | 4 | 8 hrs | Low |
Frequently Asked Questions
How long does it take to complete SOC2 readiness preparation?
For a company starting from scratch, readiness preparation typically takes 8–16 weeks. The wide range reflects starting state: a company with documented policies and active access reviews might be ready in 6 weeks; a company with no policies and no formal change management process might take 4–6 months. The fastest path is to use a GRC platform (Vanta, Drata) that automates evidence collection and provides policy templates, which can significantly compress the preparation timeline.
What's the difference between a readiness assessment and the actual SOC2 audit?
A readiness assessment is an internal review (or an informal pre-audit review with your auditor) that identifies gaps before the formal audit begins. It does not produce a SOC2 report and has no official standing. The actual SOC2 audit is performed by a licensed CPA firm following AICPA standards, results in an official Type 1 or Type 2 report, and is what enterprise buyers require. Completing this checklist is a self-administered readiness assessment — use it to find gaps before your auditor does.
Can I use this checklist to estimate audit costs?
Partially. Auditors quote based on scope (which TSC), company size, and complexity — not purely on control gaps. However, companies that are well-prepared (mostly green on this checklist) consistently receive lower quotes because auditors spend fewer hours on your engagement. As a rough rule: each significant gap area (access reviews never done, no documented policies, no evidence of monitoring) adds 4–8 hours of auditor time to your engagement at $200–$400/hour.
What happens if I fail a SOC2 control during the audit?
There is no pass/fail. SOC2 auditors report what they found — controls that operated effectively and controls that did not. A finding in your report means your report includes a description of the exception, which you must then remediate for the next audit period. For Type 1, a finding means that specific control was not designed correctly. For Type 2, it means the control did not operate consistently during the observation period. Most enterprise buyers accept reports with minor findings; significant findings across core access control or change management can affect deal progress.
Should I do a Type 1 or Type 2 audit first?
If you have an enterprise deal that requires SOC2 now, do Type 1 first. It is faster (6–8 weeks vs 10–14 months), cheaper, and produces a real report you can share with prospects while your Type 2 observation period runs. If you have no immediate deal requirement and are planning ahead, skip Type 1 and go straight to a 6-month Type 2 observation period to save the Type 1 audit cost and get to the more valuable report faster. See our complete guide on Type 1 vs Type 2 for the full analysis.
Ready to engage an auditor?
Once you have completed your readiness preparation, use our Match Wizard to find auditors that specialize in your company size and industry — matched to your stage, timeline, and audit scope.