Tools · SOC 2 Report Readiness
How ready are we for SOC 2?
Rate 32 readiness items that usually have to be true before a SOC 2 observation period starts. You get the result in words, the blocking items, and every gap in priority order. It gives no score and it is not an audit opinion. Nothing is stored.
Question 1 of 32 0 answered
Part 1 of 5
Scope and description
6 items, 5 blocking
Decide the report type and the categories first, with SOC 2 Report Scoping Assessment. Read each item's 'Operating when' first: an item is Operating only when it meets all of it and a sample of records could be taken. When in doubt, choose the lower level. Rate what you can show, not what someone tells you. Use Not applicable only where the thing the item asks about is not part of your system.
Scope and description
Ownership and governance
Controls in operation
Evidence and assessment
CPA firm, dates and customers
You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.
- About 20 minutes
- Nothing is stored, not even in your browser: reloading starts again
- If you accepted analytics, we count how far people get through the questions, never what they answer.
- Also as a workbook: SOC 2 Readiness Self-Assessment
How this is worked out, and what it is not
- Blocking items. A readiness item that, if it is below In place, means the observation period should not start yet. 22 of the 32 items are blocking, and each area holds at least one. A blocking item below In place is Priority 1. SR-13: "Do the readiness assessment before the period starts (A06, A09). Fix what is a blocking item. Do not start the period with a blocking item below In place."
- The result. Not ready to start the observation period: at least one blocking item is below In place. Ready to start, with actions: no blocking item is below In place, but some items are below Operating. Ready to start: every applicable item is Operating, and each item that does not apply has its reason recorded. The result is one of three words with the counts beside it. It is never a score, a share or a pass or a fail. An item at In place has not yet run for the three months SR-10 asks for, so expect exceptions early in the period or take a Type 1 report first; only four items can be Not applicable (RI-05, RI-06, RI-19 and RI-21), and an item left out of the result that way should be confirmed with the CPA firm. Until every item has a level, and each Not applicable has its reason, the result reads Incomplete.
- Gap priority. Priority 1 (a blocking item below In place; the period should not start): close it before the period starts. Plan it within 30 days of the assessment. Priority 2 (a blocking item at In place; it will be tested as it stands): make it Operating and keep its records. Plan it within 60 days of the assessment. Priority 3 (any other item below Operating): plan it into the period. Plan it within 90 days of the assessment. These days are house defaults. Your plan may set an earlier date, and the CPA firm may ask for one.
Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.
- This is a self-assessment. It is as good as the evidence behind each level. A second person who does not perform the controls, checking the levels of the blocking items, is the best defence against optimism (SR-11).
- The result is guidance for planning. It is not an audit decision, it is not an opinion, and it is not the CPA firm's view of your readiness. A SOC 2 report is an attestation by a licensed CPA firm, and no result here is a certification of anything.
- Ready to start means that the items are in place or operating, so that an observation period can begin. It says nothing about which criteria your controls address, what opinion you will receive or how the CPA firm will describe any exceptions. Only the CPA firm forms an opinion on a control.
- The 32 items are this pack's own list of what usually has to be true before an observation period starts. They are not the AICPA's list, and the CPA firm may ask for more, or for less. Mark an item Not applicable only where the thing it asks about is not part of your system, and give the reason. Only RI-05, RI-06, RI-19 and RI-21 can be Not applicable; on any other item it counts as not rated. An item left out of the result that way should be confirmed with the CPA firm.
- The result is one of three words, or Incomplete, with the counts beside it. Never turn the counts into a percentage or a score (SR-15). The days to plan a gap are house defaults, and your plan may set earlier dates.