SOC 2 Report Readiness — Guide

SOC 2 Report Readiness

A customer has asked for a SOC 2 report, and the work looks bigger than a questionnaire. It is bigger, but it is not mysterious. A licensed CPA firm examines your description of one system and your controls over it, against criteria published by the AICPA, and gives an opinion. You choose the system, the categories and the dates, and you write the description. The firm tests. The best preparation is ordinary: know what you promise customers, decide who owns each control, make sure the work leaves a record as a by-product, find the gaps before the auditor does, and agree the dates in writing. This pack walks you through that, in order, and helps you tell your customers where you are in the meantime.

Decide what the report is for. Draw the boundary around the service your customers rely on. Make the controls work and leave records before the period starts. Tell customers plainly what the report covers and what it does not.

Is this for you?

This pack is for you if:

• a customer, a procurement team or an investor has asked you for a SOC 2 report, and you do not yet know what that means in work, time and money;
• you are the IT or security manager who inherited the request, and no CPA firm is yet engaged;
• some controls are running, and you want to know whether to start with a Type 1 or a Type 2 report, and when;
• you already hold a report, and you want to run the next period without a gap that customers will notice.

You do not need to be an auditor, and you do not need a platform to follow it. The documents are templates that you keep.

What a SOC 2 report is, and what it is not

A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.

A licensed CPA firm examines two things: management’s description of one system, and the controls that management says operate over it. It measures them against criteria published by the AICPA, and gives its own opinion in a report. Management writes the description and signs an assertion about it. The firm does not write them for you (SR-02). The firm decides what is tested, how it is sampled, how any exceptions are described in the report and how the opinion reads.

A report is not a pass or a fail, and it is not a badge. Name it exactly: its type, its categories, its system and its period (SR-01). The report is restricted to the parties it names, so it goes to customers on the terms it states; many organisations also ask for a confidentiality agreement, which is common practice and not an AICPA rule. A SOC 3 report covers the same subject matter in less detail and is for general use.

Who needs one, and when

Nothing in law makes a SOC 2 report mandatory. A customer’s contract, a procurement policy or an investor can ask for one, and you choose whether to commission an examination. Many customers ask for a report whose last day is no more than about twelve months old. That is market practice, and each customer decides. Many organisations therefore repeat the report every year.

Start when the controls already run. A control must operate before it can be observed. Controls should have operated, with records, for at least three months before a first Type 2 period starts. That is a house default (SR-10). If they have not, expect exceptions early in a short first period, or take a Type 1 report first and begin the Type 2 period when the controls have run. Controls that are not yet running at all are ready for neither report.

Type 1 and Type 2

The pack’s default is Type 2 (SR-05). A Type 1 report is a first step, and the Type 2 period starts straight after it, by house default for about six months where no customer states a minimum.

The AICPA’s SOC 2 guide sets no minimum length for a Type 2 period. It says that a period under two months is unlikely to give the CPA firm enough evidence and that nine months is likely to be enough; the CPA firm decides. Three, six and twelve months are what advisory sources call common. That is market practice, and not an AICPA rule. The CPA firm agrees the period with you in the engagement letter, and a customer may state its own minimum. The report is issued some time after the period ends. The house default is about two months, and firms differ, so ask yours.

SOC 2 Report Scoping Assessment settles the type with 13 questions. It reads five rows from the top, and the first row that matches decides:

The five categories

The common criteria, which the Trust Services Criteria label Security, are part of every report. You add Availability, Confidentiality, Processing Integrity or Privacy only where a customer or a written commitment needs it, because each adds criteria and evidence (SR-03). The criteria number 61 in all.

Trust Services Criteria Response Register lists every criterion by number and series title, so that you can write your own controls, owners and evidence against each. The statements of the criteria are in the Library. Citing a criterion does not say that any control meets it. Only the CPA firm forms an opinion on that.

The system description

Management’s description is measured against nine topics. They matter early, because they decide what you must be able to say about the system.

These nine topics are the ones the AICPA’s description criteria (DC section 200) set. The nine criteria were read in the AICPA’s own DC section 200 (2018, with revised implementation guidance, 2022) on 20 October 2026; the titles are this pack’s own short labels for them. DC 9, significant changes, applies to a description that covers a period (a Type 2 report), and the other eight apply to both report types (DC 4 reads as of the date of the description for a Type 1 report and during the period for a Type 2). The exact wording of each criterion, and which topics your report type reads, are for the CPA firm to confirm.

System Description & Boundary Template breaks the description into twelve sections, DS-01 to DS-12, that carry the nine topics: about this description; the services provided; principal service commitments and system requirements; infrastructure; software; people; procedures; data; the boundary; risk assessment and the controls; complementary controls: customers and providers; incidents and significant changes. Draw the boundary around the one service customers rely on, and say what is outside it (SR-04). A boundary drawn to leave out the awkward part is not a boundary.

Providers and your customers’ duties

Some providers run part of your system, such as hosting. Not every supplier is one: only those whose controls matter to the criteria. You decide, for each, between two methods before the description is written (SR-06).

• Carve-out. The method that leaves the subservice organisation’s controls out of the description and the tests, and states the controls assumed of it. You are left with a list of controls you assume the provider operates (the description calls them complementary subservice organisation controls), and a duty to watch that they do. Read the provider’s own report when you reassess it (P06-A03 Supplier Security Assessment Procedure, P06 TP-09).
• Inclusive. The method that includes the subservice organisation’s relevant controls in the description and the tests. It needs the provider’s agreement: its controls are tested and it becomes a responsible party, so the CPA firm must be independent of both (the AICPA’s SOC 2 guide, paragraphs 2.14 and 2.17). It is available only where the provider cooperates.

Your customers have duties too. The description lists the controls you assume customers operate for your controls to work as described. These are complementary user entity controls. Write them from your contracts and your customers’ real duties, because a control you assume customers operate must be one they can operate (SR-07).

The path from scope to a report

The document numbers are not the order of use. Work through the steps in this order.

Start with SOC 2 Report Scoping Assessment. Then draw the boundary before anything else, because the description and every control depend on it.

The rules

The pack has twenty-four rules, SR-01 to SR-24, in six areas. Every document cites them by ID. The documents carry them out, and the rule never moves.

The numbers in the rules marked house default or market practice are starting points. The AICPA sets none of them.

Readiness

Readiness is management’s own check of the system, the controls and the evidence before the period starts. It is not the auditor’s work, and it is not an opinion. The procedure in Readiness Assessment Procedure has twelve steps. Each finding gets one of five words.

SOC 2 Readiness Self-Assessment rates thirty-two items in five areas (Scope and description; Ownership and governance; Controls in operation; Evidence and assessment; CPA firm, dates and customers), each on one of four levels: Not started, Planned, In place, Operating. 22 items are blocking: below In place, the period should not start. The result is one of three phrases, never a score or a percentage (SR-15).

A gap becomes a finding with an owner, a date and a retest (SR-14). The house defaults for planning a gap are 30 days for a blocking item, 60 for an important one and 90 for the rest. Nobody tests their own control (SR-11), so the assessor should not perform the controls it reads.

The observation period

Observation Period & Exceptions Calendar dates the period and holds everything that happens in it. It has fourteen milestones, MS-01 to MS-14, each with a rule, a role and a date calculated from the start date and the length. Every date follows the same calendar rule: the same day of a later month, or the last day of that month where it has no such day. Agree the dates in writing with the CPA firm before the period starts, and do not change them in the period without the firm (SR-16). Start the next period on the day after the last one ends, so that no day is uncovered.

For the EXAMPLE period of six months starting 1 January 2027, readiness is complete by 18 December 2026, the period ends on 30 June 2027, the next period starts on 1 July 2027, the assertion and description are final by 21 July 2027, the report is expected about 30 August 2027, a bridge letter stays suitable until 30 September 2027 and the report ages out with many customers about 30 June 2028. The dates are an illustration, and the workbook calculates them for yours.

Observation Period & Exceptions Calendar also holds:

• Checkpoints. Management looks at its own exceptions, changes, incidents and evidence at the checkpoints, with eleven prompts to read at each. The three checkpoints fall at one quarter, one half and three quarters of the period, and the review with the CPA firm is held with the second; an exception may stay Open for one month, a house default, before it is flagged. The workbook also counts how many times each frequency of control falls in the period, and warns of a control that may not fall in it at all.
• Exceptions. An exception is a test result in which a control did not operate as described for a sampled occurrence. Record it when it is found, with its cause, its date and the management response, and never remove it (SR-17). The CPA firm decides how it appears in the report.
• Changes and incidents. Record each significant change (DC 9) and each incident of the period (DC 4), and tell the CPA firm (SR-18, SR-19). This is a record. Decisions about notifying anyone follow the incident packs (P09 and P18), unchanged. This pack states no notification time.
• Bridge letters. The tracker gives each letter a status, a gap in days, the date it was issued and who signed.

Every exception gets the same five response fields (cause; what management did or will do; owner; date; effect on customers, if any) and one of four statuses (open; management response agreed; fixed and retested; accepted and described). A fix is not closed until it has operated and a retest has passed. The workbook flags an exception that stays Open for longer than the checkpoint interval. The form for a full management response is in Bridge Letter & Management Response Templates.

The bridge letter

A report covers a period that has ended, and the weeks and months since may matter to a customer who holds it. A customer may ask whether anything has changed since the last day of the period. A bridge letter answers that, once the report has been issued. Before the report exists there is nothing to bridge from: say where the report stands, in plain words (Bridge Letter & Management Response Templates, part 4). It is a letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. It is market practice and not an AICPA document.

State what the letter covers, what has changed and what you do not say. Use it for a limited gap, about three months by market practice, and not in place of the next report (SR-20). A bridge letter creates no commitment beyond your standard security commitments (P26-A09 Standard Security Commitments Schedule).

The calendar gives every row one of four words: Period still running, Bridge letter suitable, Beyond a bridge letter: send the next report, and Next report issued. It also gives the gap in days. Bridge Letter & Management Response Templates holds the letter in twelve sections, BL-01 to BL-12.

Sharing a report

Share a SOC 2 report only under a confidentiality agreement or the terms the report states (P26 QG-14), by the sharing tier the evidence library sets (P26-A05 Evidence & Attestation Library Index), and name it by its exact type, scope and dates (P26 QG-10). Bridge Letter & Management Response Templates gives the eight steps: check who is asking and why; check the terms for use; confirm a confidentiality agreement is in place; set the sharing tier; name the report exactly; send it by a controlled route; include the bridge letter if the period has ended; log it.

SOC 2 and ISO/IEC 27001

They are different things, from different bodies, about different subjects. Neither equals or replaces the other (SR-22). Say what you hold and let the customer decide what it accepts. The ISO 27001 Implementation & Certification Readiness pack (P08) covers the other route. Both ask for some of the same ordinary records, such as approved policies, a risk assessment and access reviews, which is why the pack reuses those documents. The pack does not say that one shortens the other. ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

The CPA firm

The examination is performed by a licensed CPA firm that is independent of you and enrolled in peer review. Ask for evidence of all three, ask how independence is kept, and treat an offer that is unrealistically fast, easy or cheap as a warning (SR-23). Keep the roles apart. The firm that examines you does not design or operate your controls or write your description. A readiness helper, a tool provider or a referral platform is not the auditor, and arrangements between them and the firm are a question to ask (SR-24).

Auditor (CPA Firm) Selection & Engagement Checklist has twenty-eight questions in six groups, from licence and independence to the report and what follows. These are the warning signs:

No firm, platform or readiness vendor is named or recommended in this pack.

What the pack does not cover

• SOC 1 and SOC for Cybersecurity. A SOC 1 report is about controls relevant to a customer’s financial reporting. A SOC for Cybersecurity report is about an organisation’s cybersecurity risk management programme. Both are different engagements from a SOC 2 examination, and this pack does not cover them.
• SOC 3. It is the general-use version of the same subject matter, and it is issued only with a Type 2 examination. The pack points to it and no more: ask the CPA firm (the checklist in Auditor (CPA Firm) Selection & Engagement Checklist has a question for it).
• The points of focus of the criteria, which this pack did not collect, and the statements of the criteria, which are in the Library.
• Other regimes. HIPAA, PCI DSS and other frameworks are separate subjects. Holding a SOC 2 report does not show that you meet any of them.
• Audit and legal advice. The pack helps you get ready. It does not say which opinion you will receive.

Two free web tools go with the pack, “Which SOC 2 report do we need?” and “How ready are we for SOC 2?”. Both are on the Tools page.

How it runs in practice (EXAMPLE)

Take Acme Corp (EXAMPLE), a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. It is not the distributor of the earlier packs, and every value here is made up. Its service is Ledgerline, a hosted invoicing and approvals service for finance teams. Customers rely on three commitments: 99.9% monthly availability of the web application and API (as the customer contract’s service level states it); customer data is encrypted in transit and at rest; customer data is deleted within 60 days of the end of the contract on request. It uses three providers. For two, hosting and outbound email, it uses the carve-out method; the third, a payment processor, is outside the boundary.

• Scope. A customer asked for a Type 2 report. The scoping result is Type 2, for six months. Security is in scope by default. Availability is required by a customer, and Confidentiality follows from a written commitment, so the categories are Security (33), Availability (3), Confidentiality (2): 38 criteria.
• Readiness. On 30 September 2026 the self-assessment gives the result “Not ready to start the observation period”: three items Not started, nine Planned, nine In place and eleven Operating. Six blocking items are below In place: RI-04 (a draft system description covers the nine topics); RI-13 (access to in-scope systems is reviewed periodically); RI-25 (someone who does not perform the controls has assessed them and listed the gaps); RI-26 (known gaps have owners and dates, and none that would produce an exception on a key control is open); RI-27 (a licensed CPA firm is engaged, with licence, peer review and independence checked); RI-28 (the observation period dates are agreed in writing with the CPA firm). The owner closes them before the period starts.
• Dates. Readiness is complete by 18 December 2026, fourteen days before the period starts. The period runs from 1 January 2027 to 30 June 2027. The next period starts on 1 July 2027. The report is expected about 30 August 2027, and a bridge letter stays suitable until 30 September 2027.
• A reading of the calendar on 1 August 2027. Five exceptions are logged, one of each kind. Two are Open, and one of them has waited longer than the checkpoint interval, so it is flagged. Two significant changes and two incidents are recorded, and the CPA firm has been told of each one that needed telling. Ten milestones are done, one is overdue (the mid-period review with the CPA firm) and three are coming up. No bridge letter has been sent, because the report is not issued yet; the gap stands at 32 days, one customer has been told where the report stands, and one has not. Three of the eight checks say Action needed, which is a count of work left and not a score.

Read all of this as Acme’s own record. It does not say that Acme, or any of its documents, meets any criterion, and it does not predict an opinion.

Everything in the pack

• XLSExcel

  SOC 2 Report Scoping Assessment

  The 13 questions that settle the report type, the period and the categories, with a result in words

  Open the document

• DOCWord

  System Description & Boundary Template

  The twelve sections of management’s description of the system, which carry the nine description topics

  Open the document

• XLSExcel

  Trust Services Criteria Response Register

  A register of the 61 criteria, by number and series title, for your own controls, owners and evidence (ten columns). It makes no coverage claim

  Open the document

• XLSExcel

  Control Owner & Evidence Plan

  Eighteen kinds of evidence, each with an owner, a frequency and how many times it falls in your period

  Open the document

• DOCWord

  Readiness Assessment Procedure

  The twelve steps of a readiness assessment, five finding words and a start decision

  Open the document

• XLSExcel

  Auditor (CPA Firm) Selection & Engagement Checklist

  Twenty-eight questions for a CPA firm and eight warning signs

  Open the document

• XLSExcel

  Observation Period & Exceptions Calendar

  The observation period dated: fourteen milestones, checkpoints, an exceptions log, a changes and incidents log and a bridge letter tracker, with counts

  Open the document

• XLSExcel

  SOC 2 Readiness Self-Assessment

  Thirty-two readiness items, 22 of them blocking, with a result in words and no score

  Open the document

• DOCWord

  Bridge Letter & Management Response Templates

  The bridge letter (twelve sections), the management response (eight) and the steps for sharing a report (eight)

  Open the document

No document matches those words.

The sources and their editions

The pack reads AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026.

The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer’s contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm’s opinion about the organisation’s description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.

The observation period lengths, the three-month limit of a bridge letter, the order of the steps and the sample of questions for a CPA firm are market practice and house defaults. They are not rules of the AICPA, and the CPA firm and your customers decide what they accept.

This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.

What was not read matters. The AICPA description criteria (DC section 200) were read in the AICPA’s own PDF on 20 October 2026, and the titles in this pack are its own labels for the nine criteria. The AICPA’s SOC 2 guide, the attestation standards, the points of focus, the Code of Professional Conduct and its independence rules, the peer review standards and the text of the AICPA’s April 2026 Ethics Staff Insights were not read. The carve-out, subservice organisation, user entity control, attestation standard and bridge letter descriptions come from secondary sources that agree with each other. No source read states a minimum observation period, and the AICPA guide’s statement on it was relayed by a summary and not checked. The CPA firm confirms anything that depends on them.

Limits

• Not legal advice, and not advice on an audit or attestation engagement. This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm’s opinion on management’s description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.
• No mapping. A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.
• Other packs own the rest. Policy approval is P04’s, risk assessment and acceptance P05’s, supplier assurance P06’s, access P07’s, P13’s and P14’s, incident decision rights and every notification clock P09’s and P18’s, control testing and evidence standards P20’s, recovery and restore testing P22’s and P23’s, and how a report is shared with a customer P26’s. This pack states no clock and changes no decision right.
• The dates are plans. A calendar date does not show that a control works.
• The method is the pack’s own. The order of the steps, the house defaults and the sample questions for a CPA firm are market practice. The AICPA sets none of them.
• The files are yours. Every file in the pack stays on your own systems. Nothing you enter in them goes back to the CISO Times.
• The example is not a real firm. Acme is fictional, marked EXAMPLE, and every value in it is made up.

References

• AICPA Trust Services Criteria and description criteria, report types, restricted use, carve-out and inclusive methods, complementary controls, peer review and the CPA firm questions, as the sources state them. Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.
• NIST CSF 2.0: GV.OC-03. ISO/IEC 27001:2022: Annex A 5.31, Legal, statutory, regulatory and contractual requirements, by number and title only.