SOC 2 readiness checklist.

SOC 2's Security category, the one every report includes, is built from common criteria that map directly onto this checklist. Access control proves that only the right people can reach customer data. Encryption proves the data is unreadable at rest and in transit. Audit logging proves you can reconstruct what happened and when. Incident response proves you have a plan when something goes wrong. Vendor management proves your supply chain doesn't become the breach. Change management proves deployments are reviewed, not improvised.

Auditors don't take your word for any of it. They request artefacts: a policy export, a screenshot of a firewall profile, an event log with timestamps, a ticket showing a code review. The most common reason a readiness review stalls isn't a missing control; it's missing evidence for a control that already exists. Collecting that evidence continuously, instead of the week before the audit, is the whole point of automating it.

Work top to bottom: the first pass is an evidence audit, not a fix sprint. Check an item only when you can point at the artefact that proves it: a policy document, a configuration export, or a log with timestamps. Half-checked controls are what turn into audit findings.

For every item marked Auto, the fastest path is to stop checking manually. A single ComplianceGuard scan collects the evidence from Windows, macOS, and Linux endpoints and your AWS account, hashes each item with SHA-256, and scores coverage against the criterion it maps to. What used to be a fortnight of screenshots becomes a repeatable scan you run weekly, so the evidence is current on the day the auditor asks rather than whatever was true last quarter.

Keep the checklist honest: mark the two controls you can't prove as gaps, not as done. Auditors score evidence coverage, not intention. Knowing your two real gaps on day one costs nothing, while discovering them during the observation window costs you the window.

Once every item is either checked or logged as a known gap, three things remain. First, close the gaps that are cheap to close: a missing firewall rule or a disabled audit log is an afternoon of work that removes a finding from your future report. Second, start the clock: a Type I can be assessed at a single point in time, but Type II requires your controls to operate continuously through an observation window, so the day you begin collecting evidence regularly is the day that window can start.

Third, make the checklist boring. Auditors return yearly and controls drift: new machines ship without disk encryption, a service account outlives the project it was created for, log retention quietly lapses. The teams for whom SOC 2 is cheap are the ones who run the same scan every week and treat any newly-unchecked item as a regression to fix the same day — the evidence pack then assembles itself, and the annual audit becomes a formality rather than a fire drill.