SOC 2 readiness assessment. Find the gaps before the auditor does.

What a SOC 2 readiness assessment is

A SOC 2 readiness assessment is a structured review of your current controls against the controls a SOC 2 auditor will test, run before you engage that auditor. It tells you which controls are in place with evidence, which are informal, and which are missing, so you fix the blockers before fieldwork begins.

Most companies run a readiness assessment 3 to 6 months before their planned audit start. The output is not a pass/fail verdict. It is a prioritized gap list: which controls are missing entirely, which exist but lack documented evidence, and in what order to address them so remediation does not hold up the audit window.

The assessment follows the same criteria a CPA firm will test during fieldwork, which is why running it early matters. Surprises found during the audit cost more to fix than surprises found six months out. For the full step-by-step framework, see our SOC 2 readiness assessment guide.

Readiness assessment vs. self-assessment vs. pre-assessment vs. the audit

A self-assessment is an internal gut check. A readiness assessment applies an auditor's lens to find and prioritize gaps. A pre-assessment is an informal dry run with the actual CPA firm. The SOC 2 audit itself is the formal attestation that produces the report. They are four distinct activities, not interchangeable terms.

The independence rule is the source of most confusion here. A CPA firm cannot help you build controls and then attest to those same controls. That would compromise the independence required for the formal report. Readiness work, whether a self-assessment or a structured gap analysis, happens before and separately from the audit engagement for exactly that reason.

How we score readiness, from your auditor's chair

Every control is scored in one of three states: documented with evidence, performed informally without evidence, or missing. Those states map to full credit, half credit, and no credit respectively. The credits sum to a score out of 100. The three-state model reflects what an auditor actually tests: evidence, not intentions.

The middle state is where most companies underestimate their exposure. A control you perform every week but cannot prove with a log, screenshot, or policy sign-off still becomes an exception in the auditor's report. The auditor tests what they can see, not what you describe. "We do it" without documentation is treated the same as a gap during fieldwork, which is why it earns only half credit here.

The four readiness zones

The check on this page runs this exact model in about 90 seconds and returns up to three prioritized findings so you know where to start remediation. If you want the full item-by-item version, the readiness checklist walks through each control in the same scoring framework.

What auditors check first

From the auditor's chair, a small set of controls accounts for the majority of findings that block or delay fieldwork on day one. These are the controls with both the highest weight in the Trust Services Criteria and the most consistent documentation failures we see across readiness reviews.

• Multi-factor authentication on all production access (CC6.1): every human account that can reach production systems.
• Same-day access revocation when someone leaves, with a record (CC6.2): a ticket or log showing the date and who approved the removal.
• Encryption of customer data at rest and in transit (CC6.7): configuration evidence, not just a policy statement.
• Peer-reviewed pull requests for every production change (CC8.1): enforced at the repository level, not by convention.
• A tested backup restore in the last 12 months (A1.2): a documented restore test with a success record, not just scheduled backups.
• Approved information security policies with employee acknowledgment (CC1.1): dated signatures or a platform completion report, not a shared drive folder.
• Quarterly access reviews with documented sign-off (CC6.2): a schedule, the reviewer's name, and what was found each quarter.
• A tested incident response plan (CC7.4): a tabletop exercise with a written summary, not just a plan document.
• A reviewed inventory of critical vendors and their SOC 2 reports (CC9.2): a list with review dates and a record of pulling each vendor's report.

For the full control-by-control walkthrough, see the controls auditors check first and the evidence collection guide. If you are still determining which systems fall inside your audit boundary, start with scope determination before running the assessment.

What readiness costs and how long it takes

Based on our review of publicly available pricing and firm disclosures, a formal readiness engagement with a consultant commonly runs from a few thousand dollars into the low five figures, depending on scope. Closing material gaps typically takes 60 to 90 days of focused work, with a Type 1 audit following 6 to 8 weeks out for teams that are already reasonably mature.

Teams starting from a minimal security baseline should expect the full cycle, readiness through Type 2 report, to span 9 to 12 months. These are our estimates from public records. No specific auditor has confirmed these figures to us. For a fuller breakdown of what the audit itself costs, see our SOC 2 audit cost breakdown. To map the calendar against your target report date, use the timeline calculator. Once you have a gap list in hand and are ready to engage a firm, find your SOC 2 auditor to match against firms that fit your stack and budget.