SOC 2 Compliance Checklist (2026): Free Excel and PDF

A SOC 2 compliance checklist has 11 steps in four phases. Scope: choose SOC 2 Type 1 or Type 2, select the Trust Services Criteria, and define the system boundary and system description. Build: put the ten control areas in place. Readiness: run a gap assessment, build an evidence repository, then assign control owners and run a mock audit. Audit: engage the auditor before a Type 2 observation window opens, prepare for and support fieldwork, review the draft report and bridge letters, and set up annual renewal. A first SOC 2 Type 2 needs preparation time, then an observation window of 3 to 12 months that the auditor tests, then several weeks of fieldwork and reporting.

SOC 2 Compliance Checklist at a Glance

Eleven steps in four phases, plus the observation window a Type 2 adds. Each row names the step’s owner, what it produces, and when it happens relative to that window. For a Type 1, skip the window row.

Download the checklist: Excel, PDF, or CSV, free with no signup. The Excel workbook adds status and notes columns. For a scored version that surfaces your top gaps, use the SOC 2 readiness assessment tool. The SOC 2 compliance overview has cost and timeline benchmarks by organization size.

Already have your auditor’s Prepared By Client (PBC) list? Phase 4 below covers fieldwork preparation and what triggers an exception.

---

Phase 1: Scope and Report Selection

What a SOC 2 audit costs. Our quote figures show the ballparks firms sent buyers who requested SOC 2 Type 2 quotes through SOC2Auditors.org, by company size, before final scoping. Scope (the number of Trust Services Criteria categories and systems in the boundary) is the largest cost variable you decide.

In Q3 2026, firms quoted companies with up to 50 employees a median $9,000 for a SOC 2 Type 2 audit through SOC2Auditors.org, in ballpark quotes before scoping.

1–10 employees

$9K median $7K–$14K

11–50 employees

$9K median $7K–$15K

51–200 employees

$12K median $10.5K–$16.5K

201–500 employees

$23.5K median $17.5K–$30K

500+ employees

$29K median $24.5K–$45.5K

$0$10K$20K$30K$40K$50K

The SOC 2 audit cost guide covers the full first-year budget, including readiness, tooling, and penetration testing. A boundary that is too wide inflates audit cost; one that is too narrow can leave buyers questioning whether the report covers what they care about.

Step 1: Choose Type 1 or Type 2

Type 1: A SOC 2 Type 1 report tests whether controls are suitably designed as of a specific date, with no observation period. When the controls are already in place, a SOC 2 Type 1 report often follows within two to three months of engaging the auditor.

Type 2: A SOC 2 Type 2 report tests whether controls operated effectively throughout an observation period of 3 to 12 months, sampling evidence from the full period. Its total time is your preparation, plus the window, plus several weeks of fieldwork and reporting. Most enterprise buyers ask for a Type 2.

Auditor engagedNext window

Scope (steps 1 to 3)

0–1 months

Build the control areas

1–4 months

Readiness (steps 4 to 6)

3–4 months

Observation window

4–10 months

Fieldwork and report (steps 8 to 10)

10–12 months

036912

months

If a deal needs a report within 90 days, a SOC 2 Type 1 can cover the short-term need while your Type 2 observation period starts. Auditors often begin the Type 2 window the day after the Type 1 report date.

Step 2: Select Your Trust Services Criteria

The AICPA defines five Trust Services Criteria categories. Every SOC 2 report covers the Common Criteria (the CC series), which define Security: logical and physical access, change management, risk assessment, monitoring, and incident response. Nearly every report also names Security as a category, and Security alone covers most B2B SaaS use cases. Each other category extends audit scope and cost, so add one only where customers ask for it:

• Availability: customers have SLA commitments, or uptime is a purchase criterion.
• Processing Integrity: you process financial transactions or data where accuracy and completeness are contractually required.
• Confidentiality: you handle trade secrets or NDA-governed business data.
• Privacy: you collect, use, or retain personal information subject to privacy commitments.

SOC 2 Trust Services Criteria breaks down what each category requires.

Step 3: Define the System Boundary and Draft the System Description

The system boundary lists the infrastructure, software, people, and processes the audit covers: cloud environments and regions, third-party providers with access to in-scope data, employees with system access, and physical locations if applicable. Name specific AWS regions, databases, and support tooling; “our SaaS product” is not specific enough for an auditor to evaluate.

The system description turns the approved boundary into the management narrative the CPA firm examines. Draft it from production records, not policy templates; the AICPA Description Criteria identify what management must describe. For any outside service that processes in-scope data or supports an in-scope control, state its role and whether its controls are included or carved out. Get written sign-off from engineering, legal, and the executive sponsor before engaging an auditor, because scope changes after engagement cost time and money. Our SOC 2 scope determination playbook walks through drawing the boundary.

---

Phase 2: Build Controls

Each of the Trust Services Criteria maps to controls your team builds and operates. The ten areas below cover the Security category and the most common add-on criteria. For an example control and its evidence under every criterion, filter the SOC 2 controls library to your scope or download it as an Excel template.

Build access and encryption first, then policies and monitoring, then change management and incident response, then the remaining three. Give each control a named owner and a documented operating cadence, and decide where its evidence lives before the observation window starts. A control without an owner fails silently, and an access review with no saved sign-off, or a change approved in chat instead of in the ticket, gives the auditor no evidence that the control operated.

The table after the ten areas lists the evidence auditors request and a common finding for each.

1. Access Control and Identity Management

Auditors test four access controls first: role-based access, MFA enforcement, automated provisioning and termination, and quarterly access reviews. An active account for a terminated employee is a common exception, recorded in the report’s test results. Implementation guide: SOC 2 access control policy template.

2. Data Encryption

SOC 2 does not name algorithms: criteria CC6.1 and CC6.7 ask you to protect data at rest and in transit. AES-256 at rest and TLS 1.2 or higher in transit are the common baseline. Hold keys in a managed KMS (AWS, GCP, or Azure), separate from the data, and automate annual rotation.

3. Information Security Policy Documentation

Every technical control needs a version-controlled policy that governs it. Auditors check who approved each policy and when, and that employees acknowledged it; approval by someone with authority over the area, usually an executive, is the common pattern, with acknowledgments collected each year. Typical policies cover acceptable use, data classification, encryption, access control, incident response, and vendor management.

4. System Access Logging and Monitoring

Collect logs from every in-scope system and keep them in tamper-resistant storage for at least the observation window (12 months is a common choice; SOC 2 does not set a number). Implementation guide: SOC 2 logging and monitoring controls.

5. Change Management and Configuration Control

Every production change needs a documented approval trail, usually in a ticket or pull request. Separation of duties is a tested control: the engineer who wrote the code cannot be the sole approver, and a sampled change with no approval record is reported as an exception. Implementation guide: SOC 2 change management controls.

6. Incident Response

Write a plan, add playbooks for your three most likely scenarios, and run and document a tabletop exercise at least once a year; a plan that has never been tested fails. NIST SP 800-61 Rev. 3 (2025), which organizes incident response recommendations around the NIST Cybersecurity Framework 2.0, is a useful reference.

7. Vulnerability and Patch Management

Record any delay past the SLA with a signed risk acceptance. SOC 2 exceptions and qualified opinions explains how an auditor moves from an exception to an opinion.

8. Vendor and Third-Party Risk Management

Criterion CC9.2 asks you to assess and manage risk from vendors and business partners; it does not set a review cadence. Common practice is to assess each vendor with access to in-scope data before onboarding and again each year, and to put security requirements and breach notification timelines into every vendor contract.

9. Employee Security Awareness Training

Run training at onboarding and annually. The completion log is the usual evidence that the control operated. Implementation guide: SOC 2 security controls.

10. Business Continuity and Disaster Recovery

Define an RTO and RPO for each critical system, keep automated backups in a separate geographic location, and test failover at least once a year. If Availability is in scope, criterion A1.3 requires testing recovery plan procedures, so an untested plan fails. In a Security-only report, documented test results, with the gaps found and how they were fixed, are still the strongest evidence that the plan works. Implementation guide: SOC 2 business continuity controls.

---

SOC 2 Control Areas: Build Time, Evidence, and Common Findings

What a Type 2 Window Requires From Each Control Area

A checklist line such as “review access quarterly” looks like one task. A Type 2 auditor samples from the whole observation window, so each time the task came due needs a dated record the auditor could pick. The table traces each control area to example controls in our SOC 2 controls library and the criteria they answer. The library holds 82 controls, each with its evidence and what a Type 2 period requires.

The criteria are the library’s mapping, and your auditor may assign a control to a different one. The library also holds the Processing Integrity and Privacy controls, which the ten areas above do not cover: filter it to your scope. To read a finished report instead of preparing for one, use the report review matrix.

---

Phase 3: Readiness Assessment and Evidence Collection

Readiness starts once every control has a named owner and a documented operating cadence. Audit delays often start in these three steps, not during fieldwork.

Step 4: Run a Gap Assessment Against Your Chosen TSCs

Artifact produced: Gap assessment spreadsheet mapping each TSC sub-criterion to its control, owner, and evidence status. Owner: Security lead or compliance manager.

Map each sub-criterion of your chosen Trust Services Criteria to its controls, and verify each has documented evidence for at least 30 days of operation. A gap is any criterion with no control, no named owner, or no evidence; fix the gaps that match the table’s common findings first. The SOC 2 readiness assessment produces a scored gap report, and you can compare SOC 2 readiness firms for an outside review.

Step 5: Build Your Evidence Repository

Artifact produced: Organized evidence folder (by control area and TSC criterion) with pre-staged documentation for auditor requests. Owner: Audit coordinator.

Organize evidence by control area and criterion, and pre-stage access reviews, MFA configuration, policy approvals, alert configurations, change tickets, vendor assessments, and training completions. Before fieldwork, auditors send a Prepared By Client (PBC) list and then ask for evidence by population and sample, so pre-staged evidence shortens response time.

Step 6: Assign Control Ownership and Run a Mock Audit

Artifact produced: Control ownership register; internal mock audit report with gap findings and remediation status. Owner: Security lead.

Name an owner for every control, the person who produces its evidence on the required cadence. Then run an internal mock audit before engaging your auditor: request evidence for 10 to 15 controls exactly as an auditor would, and look for gaps in completeness, format, or timeliness. Remediate every gap before a SOC 2 Type 2 observation window starts, because the auditor tests the whole window and a control fixed partway through can still produce exceptions for the months before the fix.

---

Phase 4: Auditor Selection, Fieldwork, and Post-Audit

Step 7: Select and Engage Your Auditor

Artifact produced: Signed engagement letter with observation period start date and fieldwork schedule. Owner: Executive sponsor or legal.

Once engaged, the auditor can confirm early which evidence format it expects. Also compare methodology: GRC platform integration or evidence requests by email. Before you sign, run five checks on the firm itself:

1. Licence. A US firm should hold a CPA firm permit in a US state, and a licensed CPA should sign the report; CPA licensing and SOC 2 auditor state requirements shows where to check. For a firm outside the US, ask who signs the report and under which attestation standard.
2. Peer review result. For a US firm, look up its most recent review in the AICPA Peer Review Public File: Pass, Pass with Deficiency, or Fail. Enrollment alone is not a result. How to read an AICPA peer review explains each rating.
3. Independence. If the firm, or a company in its group, did your readiness work or helped design your controls, ask which safeguards keep that work separate from the audit: AICPA independence rules call this a self-review threat. A firm that took on management responsibilities, such as designing the controls it would test, is not independent whatever the safeguards. Choosing SOC service providers lists the questions to ask.
4. What the quote covers. Ask whether readiness work, a Type 1 before the Type 2, retesting after exceptions, and scope changes are included or priced separately.
5. A sample report. A sanitized report shows how the firm writes the system description and test results your customers will read.

The figure below shows our directory’s fee bands by type of firm, which are planning estimates: for most firms, our estimates rather than published prices.

Assurance specialist, Type 1

$10K–$24K

Assurance specialist, Type 2

$15K–$45K

Full-service CPA, Type 1

$15K–$38K

Full-service CPA, Type 2

$25K–$60K

Big Four, Type 1

$40K–$145K

Big Four, Type 2

$65K–$200K

$0$50K$100K$150K$200K

Each US firm’s profile in the SOC2Auditors directory shows whether we have confirmed its CPA licence and peer-review result. To compare 187 SOC 2 audit firms by price, timeline, and industry focus, start there, or request quotes and compare them side by side.

Monthly Evidence Close During a Type 2 Window

Artifact produced: Approved monthly evidence manifest. Owner: Audit coordinator, with sign-off from each control owner.

Once the observation window opens, close evidence one month at a time instead of assembling it when the PBC list arrives. Keep every month’s record: the auditor samples from the whole window.

1. Lock the population. List every control occurrence due that month, with its system, owner, and the AICPA Trust Services Criteria it supports.
2. Reconcile occurrences. Check each against its source system and mark it complete, not due, or missing. A blank row never proves that no event occurred.
3. Keep original evidence. Save the export, ticket, log, or signed review with its source and extraction date, so an auditor can reproduce it.
4. Prove completeness. Tie each artifact’s count to the source system’s monthly total and explain any difference before sampling.
5. Trace each item. Link every file to its criterion, control, population, preparer, and reviewer. A file you cannot trace is not closed.
6. Clear high-risk queues. Confirm access reviews show removals, changes show approval before deployment, and vulnerabilities show remediation against policy.
7. Record every exception. Note the condition, owner, corrective action, and retest. Replacement evidence does not erase an exception, so keep the original.
8. Approve and freeze. Get owner sign-off, lock the version, and carry open items forward. Closure means the record is complete and reviewable, not that every control passed.

Use one row per control occurrence or sampled item. The example row shows a quarterly access review that found one problem:

The record is complete when a reviewer can follow the chain from criterion to evidence file and back without a separate explanation. The SOC 2 controls library lists the evidence for each control.

Step 8: Prepare for Fieldwork

Artifact produced: Completed PBC tracker with evidence staged per auditor request. Owner: Audit coordinator.

Assign one audit coordinator to run the PBC tracker and all auditor communications; when several people answer the same request with different versions of the evidence, they create exceptions that did not need to exist.

Step 9: Support Fieldwork

Artifact produced: Closed request log; any management comments on preliminary exception notes. Owner: Audit coordinator.

Type 2 fieldwork commonly takes a few weeks of sampling, exception follow-up, and direct testing. Answer every request within 24 to 48 hours: delays extend fieldwork and compress your review of the draft, the last point at which you can correct factual inaccuracies.

Step 10: Review Draft Report and Issue Bridge Letters if Needed

Artifact produced: Signed management response letter; finalized SOC 2 report. Owner: Executive sponsor (signatory) and audit coordinator (content review).

Read every exception description in the auditor’s draft. If you disagree with how a finding is characterized, respond formally during the management response window: it is your only opportunity to correct factual inaccuracies, and silence is taken as agreement.

A customer that needs assurance for the months after your report period ended may ask for a bridge letter, also called a gap letter. Your management writes and signs it; your auditor does not sign it or give assurance on it. It covers the time since the report period ended, not since the report was issued, and describes any material changes to the system or controls, or states that management knows of none. Bridge letters commonly cover no more than about three months, so plan the next observation period to keep that gap short.

Step 11: Set Up Annual Renewal

SOC 2 Type 2 reports are typically issued annually, and the next observation period starts the day the current one ends. In the new period, update policies, reassess vendors, and re-test business continuity and disaster recovery on their usual cadence, and schedule the period’s tabletop exercises within its first 60 days. Auditors sample the whole period, so a gap in the first 60 days is as auditable as one in month 11. Expect the second-year audit to take less effort, because scoping and evidence organization are already done; the main variable is whether control changes (new infrastructure, new vendors, team turnover) need more documentation.

---

Frequently Asked Questions

What are the SOC 2 compliance standards?

SOC 2 is governed by the AICPA and tested against the Trust Services Criteria (TSP Section 100), last updated with revised points of focus in 2022. The five categories are Security (in nearly every report), Availability, Processing Integrity, Confidentiality, and Privacy. Security has 33 common criteria in nine groups (CC1 through CC9). Many first-time audits scope to Security only.

Is there a free SOC 2 compliance checklist template?

Yes. This SOC 2 compliance checklist downloads free, with no signup, as an Excel workbook, a PDF, or a CSV. The SOC 2 controls library also downloads as Excel.

What is the difference between a SOC 2 Type 1 and Type 2 checklist?

A SOC 2 Type 1 checklist covers control design at one point in time: policies, configurations, and design documentation. A SOC 2 Type 2 checklist adds evidence that controls operated across an observation window of 3 to 12 months, such as dated access reviews, change tickets, incident logs, and training records.

How long does a SOC 2 audit take?

When controls are already in place, a SOC 2 Type 1 report often follows within two to three months of engaging the auditor. A SOC 2 Type 2 takes your preparation time, plus an observation window of 3 to 12 months (the AICPA sets no fixed minimum), plus fieldwork and reporting, which commonly take 6 to 12 weeks. GRC platforms can shorten preparation by automating evidence collection, but not the observation window.

What evidence do SOC 2 auditors actually request?

SOC 2 auditors send a Prepared By Client (PBC) list that typically asks for access reviews with manager sign-off, MFA configuration, policy approvals, SIEM alert configurations, approved change tickets, vulnerability scans with remediation tracking, vendor SOC 2 or ISO 27001 reports, training completion logs, and tabletop exercise records.

Can I do SOC 2 without a GRC platform like Vanta or Drata?

Yes. Many organizations complete SOC 2 using spreadsheet evidence trackers, GitHub for policy version control, and their existing ticketing system for change management. GRC platforms reduce manual effort but add an annual licence: observed contract medians are about $20,000 a year for Vanta and Secureframe and about $25,000 for Drata. The SOC 2 software pricing comparison covers the rest of the market.

---

Related Resources

• SOC 2 Compliance Overview
• SOC 2 Trust Services Criteria
• SOC 2 Compliance for Startups

---

Compare 187 SOC 2 audit firms by price, timeline, and specialization in the SOC2Auditors directory. If you want quotes instead, use Find My SOC 2 Auditor.