SOC 2 Readiness Self-Assessment

A single readiness assessment that shows blocking items and where to start before a SOC 2 examination. It gives no score.

Available soon

Answer it online instead: How ready are we for SOC 2?About 20 minutes, free, and nothing is stored.

Format: Excel
Size: 71 KB
Length: 9 sheets
Version: 1.1
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Do the scoping assessment first (SOC 2 Report Scoping Assessment), so that you know the report type and the categories, and the system description draft (System Description & Boundary Template) so that you know the boundary. Items RI-03 and RI-19 depend on the categories. Enter the date of this assessment on the Results sheet.
2	Ask someone who does not perform the controls to do the assessment, or record it as a self-check (SR-11: "Nobody tests their own control (P20 CA-10). The readiness assessment is done by someone who does not perform the controls it reads, or the check is recorded as a self-check.").
3	On the Assessment sheet, choose a readiness level for each item from the list. Read the item's 'Operating when' column first: an item is Operating only when all of it is true and a sample of records could be taken. When in doubt, choose the lower level.
4	Record the evidence you looked at, or the fact that decides the level, in the evidence note. Open the document or the record. Do not rely on what people say.
5	Use Not applicable only where the thing an item asks about is not part of your system, for example a restore test when Availability is not in scope. Give the reason in the reason column. An item marked Not applicable without its reason is counted as not rated. Only RI-05, RI-06, RI-19 and RI-21 can be Not applicable: on any other item it is counted as not rated. Do not mark an item Not applicable because it is hard or costly.
6	For every item below Operating, name an owner and set a target date inside the days its priority allows. The owner, target date and notes columns are for you. The Check column prompts for anything missing. Use the document that helps, named beside each item, as a starting point.
7	Read the Results sheet: the result, the blocking items, the counts by area and level, and every gap in priority order with its days. Do not start the observation period while the result is Not ready to start the observation period (SR-13).
8	Copy every gap into the deficiency and remediation tracker (P20-A08 Control Deficiency & Remediation Tracker), with its owner and date, and follow it to a retest (SR-14). Assess again before each period, and whenever the scope changes (SR-08). Keep a copy of each assessment.
9	To clear the EXAMPLE, delete the word EXAMPLE in the first column of the Assessment sheet and clear every yellow cell: the level, the reason, the evidence note, the owner, the target date and the notes. A blank copy reads Incomplete.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.

A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.

The readiness levels:

Not started: Nothing is in place for this item.

Planned: It is planned, owned and dated, but not yet in place.

In place: It is designed and running, but has not yet run for the months SR-10 asks for, or left enough records to sample.

Operating: It runs as written, an owner performs it, and the records exist for a sample to be taken. For a first Type 2 period it has run with records for at least 3 months (a house default, SR-10).

Not applicable: the item asks about something that is not part of your system. The reason is recorded. It counts neither for nor against the result.

Blocking items. A readiness item that, if it is below In place, means the observation period should not start yet. 22 of the 32 items are blocking, and each area holds at least one. A blocking item below In place is Priority 1. SR-13: "Do the readiness assessment before the period starts (A06, A09). Fix what is a blocking item. Do not start the period with a blocking item below In place."

The result. Not ready to start the observation period: at least one blocking item is below In place. Ready to start, with actions: no blocking item is below In place, but some items are below Operating. Ready to start: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score, a share or a pass or a fail. An item at In place has not yet run for the three months SR-10 asks for, so expect exceptions early in the period or take a Type 1 report first; only four items can be Not applicable (RI-05, RI-06, RI-19 and RI-21), and an item left out of the result that way should be confirmed with the CPA firm. Until every item has a level, and each Not applicable has its reason, the result reads Incomplete.

Gap priority. Priority 1 (a blocking item below In place; the period should not start): close it before the period starts. Plan it within 30 days of the assessment. Priority 2 (a blocking item at In place; it will be tested as it stands): make it Operating and keep its records. Plan it within 60 days of the assessment. Priority 3 (any other item below Operating): plan it into the period. Plan it within 90 days of the assessment. These days are house defaults. Your plan may set an earlier date, and the CPA firm may ask for one.

Rule SR-08: "Re-scope when the service, the boundary, a major provider or a customer commitment changes, and before each new period. Write down why the scope is what it is."

EXAMPLE: Acme Corp (EXAMPLE) is a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. Its self-assessment as at 2026-09-30 gives the result "Not ready to start the observation period": 6 blocking items are below In place (RI-04, RI-13, RI-25, RI-26, RI-27, RI-28), and 15 other items are below Operating. Counts: 3 Not started, 9 Planned, 9 In place, 11 Operating.

Tailoring: small organisation. One or two people may own most items. Choose target dates from the weeks those people really have. A small team should not leave the blocking items to the end: Examination owner and Executive sponsor should agree which three to close first. Keep an item's evidence note to one line and a pointer to where the record is kept.

Tailoring: customer-driven or regulated. Where a customer's contract names a date or a category, the assessment starts from that date. Rate the items against the report you will commission, not against every customer's wish. Tell the customer where you stand in words, using the approved wording (P26), and do not give a customer your readiness result as if it were an assurance.

Tailoring: IT and services run by providers. Rate an item on what you can show, not on what the provider says. Where a provider runs a control, the owner is the person who manages the provider, and Operating needs the provider's records to be available to you (P06-A03 Supplier Security Assessment Procedure). RI-05 asks for the carve-out or inclusive method for each provider.

Limitations: see the foot of the Results sheet.

Assessment

One row per readiness item. Yellow columns are yours; the columns to the right of Notes calculate. Rate each item against its 'Operating when' column.

Example	Item ID	Area	Item	Operating when	Blocking?	Readiness level	Evidence note	Document that helps	Owner (one role)	Target date	Gap priority	Days to plan	Check	Level counted (working)	Order (working)	Blocking order (working)	May be Not applicable (working)
EXAMPLE	RI-01	Scope and description	One named service is the subject of the report, and the commitments customers rely on are written down.	The service and its principal commitments are written down, match the contracts and service levels, and management has approved them.	Yes	Operating	The service and its principal commitments are in the system description draft and match the customer contract and the service level.	P32-A03 System Description & Boundary Template			None		OK	Operating			No
EXAMPLE	RI-02	Scope and description	The boundary is drawn: what is inside, what is outside, and the five components.	The boundary is documented with infrastructure, software, people, procedures and data, a diagram and the exclusions, and has been checked against how the system really runs.	Yes	In place	The boundary diagram is drawn with exclusions. It has not yet been checked against the build pipeline and the support tools.	P32-A03 System Description & Boundary Template	Head of Engineering	22 Nov 2026	Priority 2	60	OK	In place	2005		No
EXAMPLE	RI-03	Scope and description	The categories in scope are decided, with a reason for each beyond Security.	The categories are recorded with the commitment or customer that needs each, and the sponsor has agreed.	Yes	Operating	The scoping assessment records Availability and Confidentiality with the customer clause behind each. The sponsor agreed.	P32-A02 SOC 2 Report Scoping Assessment			None		OK	Operating			No
EXAMPLE	RI-04	Scope and description	A draft system description covers the nine topics.	A draft covers all nine topics, has been read against the real system by someone who operates it, and management owns it.	Yes	Planned	A first draft covers some of the nine topics. Nobody who operates the system has read it yet.	P32-A03 System Description & Boundary Template	Examination owner	23 Oct 2026	Priority 1	30	OK	Planned	1007	7	No
EXAMPLE	RI-05	Scope and description	Each subservice organisation is listed with the carve-out or inclusive method decided and its own report held or requested.	Each provider that matters is listed, the method is decided and recorded, and its latest SOC 2 report has been read for exceptions and the controls it assumes of you.	Yes	In place	Three providers are listed. Carve-out is decided for the hosting provider. The email delivery provider's report is requested and unread.	P06-A03 Supplier Security Assessment Procedure	Examination owner	22 Nov 2026	Priority 2	60	OK	In place	2008		Yes
EXAMPLE	RI-06	Scope and description	The customer controls you assume (CUECs) are listed and are real duties in your contracts or documentation.	Each assumed customer control is written down, appears in the contract or documentation customers receive, and is one a customer can operate.	No	Planned	A list of customer duties is drafted. It is not yet in the contract or the customer documentation.	P32-A03 System Description & Boundary Template	Legal	22 Dec 2026	Priority 3	90	OK	Planned	3009		Yes
EXAMPLE	RI-07	Ownership and governance	An executive sponsor and an examination owner are named.	Both are named in writing, have time set aside, and report the position at least monthly.	Yes	Operating	Sponsor and examination owner are named in writing. A monthly status slot is in both diaries.	P32-A06 Readiness Assessment Procedure			None		OK	Operating			No
EXAMPLE	RI-08	Ownership and governance	Security policies are approved by management and communicated.	The policies in scope are approved, in date, communicated to staff, and acknowledged, with records.	Yes	Operating	All in-scope policies are approved and in date. Acknowledgement records are in the policy register.	P04-A06 Policy Register & Review Schedule			None		OK	Operating			No
EXAMPLE	RI-09	Ownership and governance	A risk assessment of the service has been done in the last 12 months, with treatment decisions.	A dated risk assessment covers the service, threats to the commitments are identified, treatments have owners, and management reviewed it.	Yes	In place	A dated risk assessment of the service exists, with treatments and owners. Management has not yet minuted its review.	P05-A05 Information Security Risk Register	Head of Information Security	22 Nov 2026	Priority 2	60	OK	In place	2012		No
EXAMPLE	RI-10	Ownership and governance	Roles and responsibilities for security are defined, and management oversees them.	Roles are written, the organisation chart is current, and management reviews security regularly with minutes.	No	Operating	The organisation chart is current, and security is a standing item at the monthly leadership meeting, with minutes.	P20-A03 Control Inventory & Ownership Register			None		OK	Operating			No
EXAMPLE	RI-11	Ownership and governance	New staff are checked and trained, and the records exist.	Onboarding checks and security awareness training are completed for in-scope staff, with dated records.	No	Operating	Background checks and awareness training are complete for in-scope staff, with dated records.	P16-A07 Training Completion & Evidence Register			None		OK	Operating			No
EXAMPLE	RI-12	Controls in operation	Access is granted by approval and removed promptly when people leave.	Access requests are approved before granting, leavers lose access within the time the policy states, and each leaves a ticket or log.	Yes	Operating	Access requests are approved in tickets before granting. Leavers lose access within the policy time, and the ticket shows it.	P13-A06 Leaver Access Removal Checklist			None		OK	Operating			No
EXAMPLE	RI-13	Controls in operation	Access to in-scope systems is reviewed periodically.	Reviews of in-scope systems happen at the stated frequency, reviewers are named, removals are acted on, and the output is kept.	Yes	Planned	The first access review is scheduled for next month. No review has run on the in-scope systems yet.	P07-A06 Access Review Campaign Workbook	Head of Information Security	23 Oct 2026	Priority 1	30	OK	Planned	1016	16	No
EXAMPLE	RI-14	Controls in operation	Multi-factor authentication and privileged access are controlled.	Multi-factor authentication is enforced for in-scope access, privileged accounts are inventoried and limited, and the settings can be shown.	Yes	Operating	Multi-factor authentication is enforced by policy in the identity provider. The privileged account inventory is current.	P14-A04 Privileged & Service Account Inventory			None		OK	Operating			No
EXAMPLE	RI-15	Controls in operation	Changes to the system are reviewed, tested and approved before release.	Every production change has a record of review, test and approval by someone other than the author, and emergency changes are recorded afterwards.	Yes	Operating	Every production change has a pull request with review, a passing test run and an approval by someone other than the author.	None named			None		OK	Operating			No
EXAMPLE	RI-16	Controls in operation	Vulnerabilities are scanned for and fixed within stated times.	Scans run at the stated frequency, findings have owners and dates, and fix times are met or the exception is recorded.	Yes	In place	Scans run weekly and findings have owners. Fix times are not yet tracked against the policy.	None named	Head of Engineering	22 Nov 2026	Priority 2	60	OK	In place	2019		No
EXAMPLE	RI-17	Controls in operation	Logging and monitoring detect and escalate security events.	In-scope systems log, alerts are reviewed at the stated frequency by a named person, and escalations are recorded.	Yes	In place	Systems log centrally. Alerts are reviewed, but the review is not yet recorded each time.	None named	Head of Engineering	22 Nov 2026	Priority 2	60	OK	In place	2020		No
EXAMPLE	RI-18	Controls in operation	An incident response plan exists, roles are named, and incidents are recorded and reviewed.	The plan is current, roles have deputies, every incident has a record and a review, and a test or real incident has been run.	Yes	In place	The plan is current and roles are named. No test or tabletop has been run yet, and the incident record is new.	P09-A03 Incident Response Plan	Head of Information Security	22 Nov 2026	Priority 2	60	OK	In place	2021		No
EXAMPLE	RI-19	Controls in operation	Backups run and a restore has been tested (if Availability is in scope).	Backups succeed at the stated frequency, a restore test has been run and recorded, and recovery objectives are written down.	No	Operating	Backups succeed daily. A restore test was run last quarter and recorded. Recovery objectives are written down.	P23-A06 Immutable & Offline Backup Protection Checklist			None		OK	Operating			Yes
EXAMPLE	RI-20	Controls in operation	Customer data is encrypted in transit and at rest, and keys are managed.	Encryption settings are enforced, can be shown, and key management is documented.	No	Operating	Encryption in transit and at rest is enforced, and the settings can be shown. Key management is documented.	None named			None		OK	Operating			No
EXAMPLE	RI-21	Controls in operation	Critical suppliers are assessed and reassessed.	Critical suppliers are tiered, assessed within the tier's interval, and decisions are recorded.	Yes	In place	Critical suppliers are tiered and assessed. The reassessment dates are not yet all met.	P06-A03 Supplier Security Assessment Procedure	Head of Information Security	22 Nov 2026	Priority 2	60	OK	In place	2024		Yes
EXAMPLE	RI-22	Evidence and assessment	Every control in scope has one named owner.	Each control has a named owner who performs or supervises it and knows what record it leaves.	Yes	In place	Most controls have a named owner in the control register. A few still show a team and not a person.	P32-A05 Control Owner & Evidence Plan	Examination owner	22 Nov 2026	Priority 2	60	OK	In place	2025		No
EXAMPLE	RI-23	Evidence and assessment	Evidence is produced by doing the work and can be retrieved without reconstruction.	For a sample of controls, evidence from the last months can be produced from the system of record in a day, dated and attributable.	Yes	In place	Evidence can be pulled from the systems of record for most controls. Some still need a person to assemble it.	P20-A07 Control Evidence Standards Checklist	Examination owner	22 Nov 2026	Priority 2	60	OK	In place	2026		No
EXAMPLE	RI-24	Evidence and assessment	Evidence is kept for the whole period and after.	Retention settings cover the period and the time to the report, and no one deletes evidence by routine.	No	Planned	Retention settings for logs and tickets are being reviewed. They do not yet cover the whole period and the time to the report.	P32-A05 Control Owner & Evidence Plan	Head of Engineering	22 Dec 2026	Priority 3	90	OK	Planned	3027		No
EXAMPLE	RI-25	Evidence and assessment	Someone who does not perform the controls has assessed them and listed the gaps.	A readiness assessment by an independent person is complete, with findings in the five words and dispositions.	Yes	Not started	An independent readiness assessment has not started. Someone outside the control owners is to be named.	P32-A06 Readiness Assessment Procedure	Executive sponsor	23 Oct 2026	Priority 1	30	OK	Not started	1028	28	No
EXAMPLE	RI-26	Evidence and assessment	Known gaps have owners and dates, and none that would produce an exception on a key control is open.	Every gap is tracked to a retest; none on a key control is open; fixes have operated before retest.	Yes	Planned	Gaps found so far are in the deficiency tracker with owners. Dates are not yet set for all of them.	P20-A08 Control Deficiency & Remediation Tracker	Examination owner	23 Oct 2026	Priority 1	30	OK	Planned	1029	29	No
EXAMPLE	RI-27	CPA firm, dates and customers	A licensed CPA firm is engaged, with licence, peer review and independence checked.	An engagement letter is signed, the checks in the selection checklist are recorded, and the firm has agreed scope and categories.	Yes	Planned	Two CPA firms have been asked for proposals. Licence, peer review and independence are not yet checked.	P32-A07 Auditor (CPA Firm) Selection & Engagement Checklist	Executive sponsor	23 Oct 2026	Priority 1	30	OK	Planned	1030	30	No
EXAMPLE	RI-28	CPA firm, dates and customers	The observation period dates are agreed in writing with the CPA firm.	Start and end dates are in the engagement letter or an email the firm has confirmed, and the calendar holds them.	Yes	Not started	No dates are agreed. They wait for the engagement letter.	P32-A08 Observation Period & Exceptions Calendar	Examination owner	23 Oct 2026	Priority 1	30	OK	Not started	1031	31	No
EXAMPLE	RI-29	CPA firm, dates and customers	A plan exists for telling customers the position, including a bridge letter for the gap.	Approved words for customers exist, the bridge letter template is ready, and a named person releases it.	No	Planned	Draft words for customers exist. The bridge letter template is not yet adapted and nobody is named to release it.	P32-A10 Bridge Letter & Management Response Templates	Customer-facing lead	22 Dec 2026	Priority 3	90	OK	Planned	3032		No
EXAMPLE	RI-30	CPA firm, dates and customers	A way to record significant changes and incidents during the period is ready.	Changes and incidents of the period are recorded as they happen, with dates, and reach the CPA firm.	No	Planned	A spreadsheet for changes and incidents of the period is drafted. It is not yet in use.	P32-A08 Observation Period & Exceptions Calendar	Examination owner	22 Dec 2026	Priority 3	90	OK	Planned	3033		No
EXAMPLE	RI-31	CPA firm, dates and customers	Control owners have time for the CPA firm's requests during fieldwork.	Owners have been told the weeks, a channel exists for requests, and the examination owner tracks them.	No	Not started	Control owners have not yet been told the weeks of fieldwork, and no channel exists for requests.	P32-A05 Control Owner & Evidence Plan	Examination owner	22 Dec 2026	Priority 3	90	OK	Not started	3034		No
EXAMPLE	RI-32	CPA firm, dates and customers	How the report will be shared with customers is decided.	A confidentiality agreement or the report's own terms are used, a sharing tier is set (P26 QG-14), and the report is named by its exact type, scope and dates.	No	Planned	The sharing tier is chosen. The confidentiality terms and the exact way the report will be named are not yet written.	P26-A05 Evidence & Attestation Library Index	Legal	22 Dec 2026	Priority 3	90	OK	Planned	3035		No

Results

Results

The result, the blocking items, readiness by area and every gap in priority order, calculated from the Assessment sheet. Only the yellow settings are yours.

EXAMPLE: the example organisation's self-assessment. Clear the EXAMPLE column and the yellow answers to use your own.

Settings

Date of this assessment			30 Sep 2026		EXAMPLE: the date of the example assessment. The plan-by dates count from it.
Assessed by (role)			EXAMPLE: Examination owner		The person who rated the items and checked the evidence. Not a person who performs the controls (SR-11).

The result

In one line	Not ready to start the observation period: 6 blocking items below In place, 15 other items below Operating.
Result	Not ready to start the observation period		Not ready to start the observation period: at least one blocking item is below In place. Ready to start, with actions: no blocking item is below In place, but some items are below Operating. Ready to start: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score, a share or a pass or a fail. An item at In place has not yet run for the three months SR-10 asks for, so expect exceptions early in the period or take a Type 1 report first; only four items can be Not applicable (RI-05, RI-06, RI-19 and RI-21), and an item left out of the result that way should be confirmed with the CPA firm.
Blocking items below In place	6	Each is a Priority 1 gap, listed first below.
What SR-13 asks	Do not start the observation period: 6 blocking items below In place. Close them first (SR-13).

Readiness by area

Area	Items	Operating	In place	Planned	Not started	Not applicable	Not rated	Blocking below In place	At Operating
Scope and description	6	2	2	2	0	0	0	1	2 of 6 at Operating
Ownership and governance	5	4	1	0	0	0	0	0	4 of 5 at Operating
Controls in operation	10	5	4	1	0	0	0	1	5 of 10 at Operating
Evidence and assessment	5	0	2	2	1	0	0	2	0 of 5 at Operating
CPA firm, dates and customers	6	0	0	4	2	0	0	2	0 of 6 at Operating
All areas	32	11	9	9	3	0	0	6	11 of 32 at Operating
Read the counts. An item In place works but is not yet running long enough to leave records to sample. An item marked Not applicable is left out of 'at Operating'. A count stays a count.

The blocking items below In place (Priority 1)

No.	Item ID	Item	Level	Area
1	RI-04	A draft system description covers the nine topics.	Planned	Scope and description	4
2	RI-13	Access to in-scope systems is reviewed periodically.	Planned	Controls in operation	13
3	RI-25	Someone who does not perform the controls has assessed them and listed the gaps.	Not started	Evidence and assessment	25
4	RI-26	Known gaps have owners and dates, and none that would produce an exception on a key control is open.	Planned	Evidence and assessment	26
5	RI-27	A licensed CPA firm is engaged, with licence, peer review and independence checked.	Planned	CPA firm, dates and customers	27
6	RI-28	The observation period dates are agreed in writing with the CPA firm.	Not started	CPA firm, dates and customers	28

Blocking items are listed in the order of the Assessment sheet. The list is empty when no blocking item is below In place. The most that can appear is 22, the number of blocking items.

Every gap, in priority order

No.	Item ID	Item	Priority	Level	Days	Plan by	Owner	Row
1	RI-04	A draft system description covers the nine topics.	Priority 1	Planned	30	30 Oct 2026	Examination owner	4
2	RI-13	Access to in-scope systems is reviewed periodically.	Priority 1	Planned	30	30 Oct 2026	Head of Information Security	13
3	RI-25	Someone who does not perform the controls has assessed them and listed the gaps.	Priority 1	Not started	30	30 Oct 2026	Executive sponsor	25
4	RI-26	Known gaps have owners and dates, and none that would produce an exception on a key control is open.	Priority 1	Planned	30	30 Oct 2026	Examination owner	26
5	RI-27	A licensed CPA firm is engaged, with licence, peer review and independence checked.	Priority 1	Planned	30	30 Oct 2026	Executive sponsor	27
6	RI-28	The observation period dates are agreed in writing with the CPA firm.	Priority 1	Not started	30	30 Oct 2026	Examination owner	28
7	RI-02	The boundary is drawn: what is inside, what is outside, and the five components.	Priority 2	In place	60	29 Nov 2026	Head of Engineering	2
8	RI-05	Each subservice organisation is listed with the carve-out or inclusive method decided and its own report held or requested.	Priority 2	In place	60	29 Nov 2026	Examination owner	5
9	RI-09	A risk assessment of the service has been done in the last 12 months, with treatment decisions.	Priority 2	In place	60	29 Nov 2026	Head of Information Security	9
10	RI-16	Vulnerabilities are scanned for and fixed within stated times.	Priority 2	In place	60	29 Nov 2026	Head of Engineering	16
11	RI-17	Logging and monitoring detect and escalate security events.	Priority 2	In place	60	29 Nov 2026	Head of Engineering	17
12	RI-18	An incident response plan exists, roles are named, and incidents are recorded and reviewed.	Priority 2	In place	60	29 Nov 2026	Head of Information Security	18
13	RI-21	Critical suppliers are assessed and reassessed.	Priority 2	In place	60	29 Nov 2026	Head of Information Security	21
14	RI-22	Every control in scope has one named owner.	Priority 2	In place	60	29 Nov 2026	Examination owner	22
15	RI-23	Evidence is produced by doing the work and can be retrieved without reconstruction.	Priority 2	In place	60	29 Nov 2026	Examination owner	23
16	RI-06	The customer controls you assume (CUECs) are listed and are real duties in your contracts or documentation.	Priority 3	Planned	90	29 Dec 2026	Legal	6
17	RI-24	Evidence is kept for the whole period and after.	Priority 3	Planned	90	29 Dec 2026	Head of Engineering	24
18	RI-29	A plan exists for telling customers the position, including a bridge letter for the gap.	Priority 3	Planned	90	29 Dec 2026	Customer-facing lead	29
19	RI-30	A way to record significant changes and incidents during the period is ready.	Priority 3	Planned	90	29 Dec 2026	Examination owner	30
20	RI-31	Control owners have time for the CPA firm's requests during fieldwork.	Priority 3	Not started	90	29 Dec 2026	Examination owner	31
21	RI-32	How the report will be shared with customers is decided.	Priority 3	Planned	90	29 Dec 2026	Legal	32

Order: Priority 1 first, then Priority 2, then Priority 3; within a priority, in the order of the Assessment sheet. The days are the most the priority allows (Priority 1: 30, Priority 2: 60, Priority 3: 90); they are house defaults. The plan-by date counts from the date of the assessment. The grey Row column is the item's position in the assessment table.

Limitations

This is a self-assessment. It is as good as the evidence behind each level. A second person who does not perform the controls, checking the levels of the blocking items, is the best defence against optimism (SR-11).

The result is guidance for planning. It is not an audit decision, it is not an opinion, and it is not the CPA firm's view of your readiness. A SOC 2 report is an attestation by a licensed CPA firm, and no result on this sheet is a certification of anything.

Ready to start means that the items are in place or operating, so that an observation period can begin. It says nothing about which criteria your controls address, what opinion you will receive or how the CPA firm will describe any exceptions. Only the CPA firm forms an opinion on a control.

The 32 items are this pack's own list of what usually has to be true before an observation period starts. They are not the AICPA's list, and the CPA firm may ask for more, or for less. Mark an item Not applicable only where the thing it asks about is not part of your system, and give the reason. Only RI-05, RI-06, RI-19 and RI-21 can be Not applicable; on any other item it counts as not rated. An item left out of the result that way should be confirmed with the CPA firm.

The result is one of three words, or Incomplete, with the counts beside it. Never turn the counts into a percentage or a score (SR-15). The days to plan a gap are house defaults, and your plan may set earlier dates.

Lists

Level	YesNo	AreaName	PriorityName	PriorityDays
Not started	Yes	Scope and description	Priority 1	30
Planned	No	Ownership and governance	Priority 2	60
In place		Controls in operation	Priority 3	90
Operating		Evidence and assessment
Not applicable		CPA firm, dates and customers

Definitions

Definitions

Term	Meaning in this workbook
Readiness	Management's own check of the system, the controls and the evidence before the observation period starts. It is not the auditor's work and it is not an opinion.
Level: Not started	Nothing is in place for this item.
Level: Planned	It is planned, owned and dated, but not yet in place.
Level: In place	It is designed and running, but has not yet run for the months SR-10 asks for, or left enough records to sample.
Level: Operating	It runs as written, an owner performs it, and the records exist for a sample to be taken. For a first Type 2 period it has run with records for at least 3 months (a house default, SR-10).
Level: Not applicable	The item asks about something that is not part of your system. The reason is recorded. It is left out of the counts at Operating, and it is not a gap.
Blocking item	A readiness item that, if it is below In place, means the observation period should not start yet. Below In place it is a Priority 1 gap.
Result	Not ready to start the observation period: at least one blocking item is below In place. Ready to start, with actions: no blocking item is below In place, but some items are below Operating. Ready to start: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score, a share or a pass or a fail. An item at In place has not yet run for the three months SR-10 asks for, so expect exceptions early in the period or take a Type 1 report first; only four items can be Not applicable (RI-05, RI-06, RI-19 and RI-21), and an item left out of the result that way should be confirmed with the CPA firm. Incomplete: an item has no level yet, or is Not applicable without its reason.
Priority 1: A blocking item below In place; the period should not start	Close it before the period starts. Plan it within 30 days of the assessment (a house default).
Priority 2: A blocking item at In place; it will be tested as it stands	Make it Operating and keep its records. Plan it within 60 days of the assessment (a house default).
Priority 3: Any other item below Operating	Plan it into the period. Plan it within 90 days of the assessment (a house default).
Gap	An item below Operating, other than one marked Not applicable. Every gap needs an owner, a date and a retest (SR-14).
Attestation	An independent professional's written opinion on a subject that someone else (management) is responsible for. A SOC 2 report is an attestation. It is not a certificate and it is not a pass or a fail.
Observation period	The period a Type 2 report covers, from its first day to its last. Also “the period”.
CPA firm (service auditor)	The licensed CPA firm that examines management's description and the controls, and issues the report. Also “the CPA firm” and “the auditor” in this pack.
Subservice organisation	A provider that runs part of the system for you, such as hosting. Not every supplier is one: only those whose controls matter to the criteria.
Carve-out method	The method that leaves the subservice organisation's controls out of the description and the tests, and states the controls assumed of it.
Customer controls (CUEC)	A complementary user entity control: a control the description says customers must operate for your controls to work as described.
Exception	A test result in which a control did not operate as described for a sampled occurrence. Some sources call these deviations. The auditor decides how one is described in the report. Management records the cause and its response, and also records those it finds itself in the period.
Bridge letter	A letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document.
House default	A number this pack suggests where no rule gives one, such as the days to plan a gap. Change it to what your plan and your CPA firm ask for.
RI-01 to RI-32	The readiness items of this pack. 32 items in 5 areas.
EXAMPLE	A worked example: a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report, as at 2026-09-30. Clear the EXAMPLE column and the yellow answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.2 — Internal audit	The whole workbook: a planned check of readiness by someone who does not perform the controls, with the results recorded
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Results: the gaps found, in priority order, for improvement
AICPA, SOC 2	AICPA Trust Services Criteria (TSP section 100), introduction: a Type 2 SOC 2 report gives an opinion on the suitability of design and operating effectiveness of controls throughout a specified period and describes the tests and results; a Type 1 report addresses the same subject matter without an opinion on operating effectiveness or a description of tests, and is as of a specified date. The Journal of Accountancy (2016, an AICPA publication) gives the same split for SOC 1 and says SOC 2 reports come in both types. Neither source states a minimum period	Items RI-03 and RI-27 and the result: the two report types, and why the result says nothing about the opinion
AICPA, SOC 2	Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022): five categories. Security is the category whose criteria, CC1 to CC9, are the “common criteria”: they apply to every report, and a complete set of criteria is the common criteria plus those of each other category chosen. (CC2 is titled Information and Communication in the 2022 edition; earlier editions print Communication and Information.) The criteria number 61: 33 Security, 3 Availability, 2 Confidentiality, 5 Processing Integrity and 18 Privacy. Cited by number and series title only; the statements are in the Library	Items RI-03, RI-04 and RI-19: the five categories, of which Security is in scope by default
AICPA, SOC 2	Where a service organisation uses a subservice organisation, the description uses either the carve-out method (the subservice organisation's relevant controls are left out of the description and the tests, and the description names the controls it assumes the subservice organisation operates) or the inclusive method (those controls are included). Management chooses for each subservice organisation. DC 7 in DC section 200 (read 20 October 2026) says what the description discloses under each method: under the inclusive method the nature of the service, the necessary controls, the relevant aspects of the subservice organisation's system and the portions attributable to it; under the carve-out method the nature of the service, the criteria intended to be met by the subservice organisation's controls and the types of controls assumed (CSOCs). The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) adds that the inclusive method needs the subservice organisation's agreement, that its controls are subject to the service auditor's procedures, and that it makes the subservice organisation a responsible party, so the CPA firm must be independent of both (paragraphs 2.14 and 2.17); the text of the attestation standards was not read	Items RI-05, RI-06 and RI-21: the carve-out and inclusive methods, and the controls assumed of a provider
AICPA, SOC 2	SOC 2 CC3.1, Risk Assessment	Item RI-09: the risk assessment of the service, with treatment decisions
AICPA, SOC 2	SOC 2 CC9.2, Risk Mitigation	Items RI-05 and RI-21: the assessment and management of risks from providers

Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.

Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.

The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer's contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm's opinion about the organisation's description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.