SOC 2 Readiness Assessment

Find out where you actually stand — before your auditor does.

0 of 15 answered

1 Policies & Documentation

Written policies are the foundation auditors check first.

Does your company have a written Information Security Policy approved by leadership?

Yes

Partial

No

Do you have documented procedures for access control, change management, and incident response?

Yes

Partial

No

Are these policies reviewed and updated at least annually?

Yes

Partial

No

2 Access Controls

Auditors scrutinize who can access what — and whether access is revoked promptly.

Is access to production systems restricted to authorized personnel only (least privilege)?

Yes

Partial

No

Do you use multi-factor authentication for all production system access?

Yes

Partial

No

Is there a formal offboarding process that revokes access within 24 hours of employee departure?

Yes

Partial

No

3 Risk & Vendor Management

Third-party risk is one of the most common audit failure points.

Have you conducted a formal risk assessment in the past 12 months?

Yes

Partial

No

Do you maintain an inventory of third-party vendors with access to your systems or data?

Yes

Partial

No

Do you have signed security agreements (BAAs, DPAs) with key vendors?

Yes

Partial

No

4 Monitoring & Incident Response

Continuous monitoring shows auditors your controls run over time, not just on audit day.

Do you have centralized logging enabled for production systems (logs retained 90+ days)?

Yes

Partial

No

Is there a documented incident response plan that has been tested in the past year?

Yes

Partial

No

Do you have security monitoring/alerting in place (SIEM, CloudTrail, etc.)?

Yes

Partial

No

5 Change Management & Availability

Availability and change controls protect service continuity — critical for Type 2 audits.

Do all production changes go through a formal review and approval process?

Yes

Partial

No

Do you have automated backups with tested restore procedures?

Yes

Partial

No

Is there a business continuity plan covering your critical systems?

Yes

Partial

No

Answer all 15 questions to calculate your score.

What This Assessment Covers

The 15 questions map directly to the five SOC 2 control domains auditors test. A gap in any area will be flagged during your audit — better to find them now.

Policies & Documentation

Written policies are auditors' first request. Without an approved Information Security Policy and documented procedures, your audit cannot begin.

Access Controls

Least-privilege access, MFA enforcement, and prompt offboarding are the three most-tested access controls in every SOC 2 audit.

Risk & Vendor Management

A formal annual risk assessment and a third-party vendor inventory with signed agreements are non-negotiable for audit-readiness.

Monitoring & Incident Response

Centralized logs, tested IRP, and live security alerting demonstrate your controls operate continuously — the core of a Type 2 audit.

Change Management & Availability

Formal change approvals, backup testing, and a business continuity plan protect service uptime — required for the Availability Trust Service Criterion.

Your score maps to these areas

Each section scores out of 20 points. Your results show where you're strong and where remediation effort will have the highest audit impact.

The 3 Most Common Readiness Gaps

Based on pre-audit assessments at hundreds of companies, these three gaps appear most often — and delay audits by months when left unaddressed.

#1

Incomplete or unapproved access controls

Most companies have some access restrictions in place but haven't formally documented the policy, left over-permissioned accounts from past employees, or never enforced MFA universally. Auditors test every production access path. A single shared credential or orphaned account is a finding.

Fix: Run a full access audit, enforce MFA via your IdP, and build an offboarding checklist into your HRIS.

#2

Missing or outdated documentation

Controls that exist in practice but haven't been written down don't count during an audit. Many teams have solid security habits but no policy document, no procedure runbooks, and no evidence of annual reviews. Auditors want to see written, leadership-approved policies with revision history.

Fix: Use a GRC platform or simple templates to document your ISP and key procedures. Get a signature from your CTO or CISO.

#3

No formal vendor risk management

SaaS companies typically rely on dozens of third-party tools that touch customer data — yet many have no inventory of these vendors, no risk ratings, and no signed data processing agreements. Every vendor with access to production data is in scope for your auditor's TPRM review.

Fix: Build a vendor inventory spreadsheet listing each vendor, what data they access, and whether you have a signed DPA or BAA.

Frequently Asked Questions

What is a SOC 2 readiness assessment?

A SOC 2 readiness assessment is a structured review of your current security controls against the controls auditors will test during a SOC 2 audit. It identifies which controls you have in place, which are partial or undocumented, and which are missing entirely. The output is a gap list that tells you exactly what to remediate — and in what order — before engaging an auditor. Most companies do a readiness assessment 3–6 months before their planned audit start date.

How long does it take to get SOC 2 ready?

It depends on your starting point. Companies with mature security programs and existing documentation can be ready for a Type 1 audit in 6–8 weeks. Companies starting from scratch typically need 6–12 months to implement controls, gather evidence, and complete the audit window required for a Type 2 report. Our assessment gives you a personalized time estimate based on your specific gap profile, calculated from the number and severity of control gaps found.

What happens if I score low?

A low score means you have work to do before scheduling an audit — which is exactly why a readiness assessment exists. You should not engage an auditor while you have significant control gaps: you'll spend more time responding to findings, potentially need a re-audit, and pay more in total. Use your gap list to prioritize remediation by section. Start with policies (easiest wins), then access controls, then monitoring. Many companies close major gaps in 60–90 days with focused effort.

Should I hire a consultant vs. an auditor to close gaps?

These are two different roles. An auditor attests to your controls — they cannot help you design or implement them (independence requirements prevent this). A compliance consultant or vCISO can help you build the controls and evidence library before the audit. If you have many gaps, hiring a consultant for 1–3 months of readiness work typically reduces your total audit cost by shortening the audit engagement. If you have only a few well-understood gaps, you may be able to remediate internally using your gap list and self-service tools like GRC platforms.

SOC 2 Readiness Assessment