Menu
Auditors
Our picks by fit, each with a passed peer review
Every listed firm, filterable by price and timeline
Consultants
Readiness, pentest, vCISO, and ISO 27001 firms in one list
Software
Every platform we profile, with sourced prices and fit
Our picks by buyer fit, with the tradeoffs
Published prices, add-ons, and audit fees
Learn
Articles on cost, controls, timelines, and auditor choice
Free Tools
A few questions, then your best-fit auditors
Fit-ranked platforms with observed price bands
Category·28 articles
Preparing for a SOC 2 audit means scoping your systems and criteria, running a readiness assessment, closing control gaps, and collecting evidence your auditor can test. A Type 2 audit then needs those controls running for the whole observation period.
Operational guides for the months before fieldwork starts. Readiness assessments, control implementation, evidence collection, and the prep tasks that actually shorten the engagement.
5 articles
Start with SOC 2 Readiness Assessment.
Free SOC 2 compliance checklist in Excel, PDF, or CSV: 11 steps in four phases with owners, outputs, and timing, plus the 10 control areas auditors test.
Read insight →A DIY SOC 2 readiness checklist across 8 control areas: self-verify your controls, gather evidence, and prioritize remediation before you engage an audit firm.
Read insight →How to set SOC 2 scope: the service, system boundary, Trust Services categories, vendors and report type, plus a one-page worksheet to send to your auditor.
Read insight →SOC 2 carve-out vs. inclusive method explained: what a subservice organization is, which method almost every startup uses, and what changes in your report either way.
Read insight →SOC 2 requires readiness assessment, control implementation, evidence collection, and an independent audit. Step-by-step plan to get your report.
Read insight →12 articles
Start with SOC 2 Controls List.
How SOC 2 change management controls map to CC8.1, what auditors trace from ticket to deploy log, a worked 1,100-deployment sample, and common failures.
Read insight →SOC 2 CC6 and CC7 explained: access controls, system operations, evidence, and common audit gaps across CC6.1–CC6.8 and CC7.1–CC7.5.
Read insight →Build SOC 2 security awareness training that auditors can test, with clear TSC mapping, cadence, curriculum, completion logs, and evidence examples.
Read insight →SOC 2 does not name algorithms or TLS versions. Map encryption at rest and in transit to CC6.1, CC6.7, and C1.1, then keep the evidence auditors sample.
Read insight →Use this SOC 2 internal control procedure template to turn a risk and policy into ordered steps, evidence, exception handling, and a record an auditor can trace.
Read insight →A copy-usable SOC 2 access control policy template mapped to CC6, plus the sections, sample clauses, and evidence auditors actually test for.
Read insight →How SOC 2 audits business continuity and disaster recovery: CC9.1 and A1.1 to A1.3, a worked RTO/RPO tier table, and a completed recovery-test record.
Read insight →SOC 2 Type 2 controls are tested for operating effectiveness, not just design, over a 3–12 month observation window. How auditors sample evidence, a logging/monitoring walkthrough, and how Type 2 differs from Type 1.
Read insight →SOC 2 vendor management requirements: what auditors request under CC9.2, how to tier vendors, a worked payroll review and a free inventory sheet.
Read insight →SOC 2 does not require a penetration test. CC4.1 lists it as one way to evaluate controls. See where a test requirement comes from and what to keep.
Read insight →Learn how a red team assessment strengthens security and supports SOC 2 audit readiness. Define scope, methodology, metrics, timelines, and provider selection.
Read insight →5 articles
Start with SOC 2 Evidence Request List.
The exact policies, procedures, and evidence a SOC 2 auditor requests, organized by category, with owner notes and common pitfalls.
Read insight →Free SOC 2 risk register in Excel and CSV, prefilled with five worked SaaS risks. See how auditors test CC3.1 to CC3.4 and what to hand them.
Read insight →Answer vendor security questionnaires with a six-step workflow, evidence matrix, reusable response library, and clear rules for SIG, CAIQ, and custom forms.
Read insight →Find the current ServiceNow SOC 2 Type 2 report, check its coverage period, and understand when ServiceNow IRM can support your own SOC 2 audit.
Read insight →6 articles
Start with SOC 2 Audit Report Guide.
A step-by-step guide to GCP SOC 2 compliance. Learn to map responsibilities, configure services, collect evidence, and prepare for your Type 1 or Type 2 audit.
Read insight →What changes in a second SOC 2 Type 2 audit: how the new period connects to the last, what the auditor does with prior exceptions, which evidence cannot carry over, and a renewal checklist.
Read insight →A SOC 2 bridge letter explains changes and control continuity between report periods. Learn when buyers request one and how to issue a credible letter.
Read insight →SOC 2 sample size isn't set by the AICPA. Learn the real drivers, control frequency, population size, tolerable deviation rate, and risk, plus ranges commonly seen in practice.
Read insight →The SOC 2 red flags customers' security reviewers check, from "certified" claims and 3-month windows to thin audits, and what to fix before your next audit.
Read insight →Want hands-on help closing gaps before fieldwork starts? Compare consultants that run SOC 2 readiness engagements.