SOC 2 (System and Organization Controls 2) is the de-facto trust standard for SaaS and cloud-service companies. Prospects and enterprise customers increasingly require a SOC 2 Type II report before signing. This checklist walks you through every major requirement across the five Trust Service Criteria (TSC) so you can walk into your audit room fully prepared.
Understanding the Five Trust Service Criteria
The AICPA's Trust Service Criteria replace the older Trust Services Principles. Your audit scope must include Security (CC) as the foundational category; the other four (Availability, Processing Integrity, Confidentiality, Privacy) are included based on your service commitments.
Security (Common Criteria) — Required for All SOC 2 Audits
CC1 — Control Environment
- Board-level oversight of security and compliance
- Documented organisational chart with clear accountability
- Annual security training completion >90% of workforce
- Background checks on all employees with access to production systems
CC2 — Communication & Information
- Information Security Policy reviewed and approved in the last 12 months
- Acceptable Use Policy distributed to all employees
- Security incidents communicated to affected customers within SLA
- Vendor-facing security terms in all contracts
CC6 — Logical & Physical Access
- Multi-factor authentication (MFA) enforced for all production access
- Unique accounts — no shared credentials
- Quarterly access reviews removing stale users
- Role-based access control (RBAC) documented and enforced
- Offboarding procedures revoke access within 24 hours of termination
CC7 — System Operations
- Vulnerability scanning runs at least monthly; critical findings resolved within 30 days
- Penetration test conducted annually by an independent third party
- Security monitoring with alerting on anomalous events
- Incident response plan (IRP) tested at least annually
CC8 — Change Management
- All production changes approved via documented change management process
- Separation of duties between developers and production deployment
- Rollback procedures defined and tested
Availability (A-Series)
- Uptime SLA commitments documented and monitored
- Disaster recovery plan (DRP) with tested RTO/RPO targets
- Redundant infrastructure with no single points of failure
- Capacity monitoring with automated alerting before thresholds are breached
SOC 2 Readiness: Pre-Audit Checklist Table
| Area | Key Evidence Required | Typical Gap |
|---|---|---|
| Access Control | Access review reports, MFA screenshots, RBAC matrix | No documented quarterly reviews |
| Vulnerability Management | Scan reports, remediation tickets, pen test report | Critical findings older than 30 days unresolved |
| Change Management | PR approvals, deployment logs, change tickets | Developers deploying to production directly |
| Incident Response | IRP document, tabletop exercise records | Plan exists but never tested |
| Vendor Management | Vendor register, security reviews, contracts with DPAs | No formal vendor risk assessments |
| Security Training | Training completion records, phishing simulation results | Training not tracked or <90% completion |
12-Month Evidence Collection Calendar
SOC 2 Type II auditors examine evidence across the full audit period — typically 6 or 12 months. You must demonstrate continuous operation of controls, not just a point-in-time snapshot. Set calendar reminders for:
- Monthly: Vulnerability scans, access anomaly reviews, monitoring alert review
- Quarterly: Access reviews, vendor risk reviews, policy reviews
- Annually: Penetration test, business continuity test, full security training cycle
Choosing the Right SOC 2 Auditor
Only a licensed CPA firm or AICPA-registered firm can issue a SOC 2 report. Look for firms with experience in your industry (SaaS, healthcare tech, fintech). Request sample reports and ask for references from similar-sized companies. Expect Type I reports to cost $15,000–$30,000 and Type II reports to cost $30,000–$80,000 depending on scope.
How Barafaa Accelerates SOC 2 Readiness
Barafaa's platform auto-maps evidence across all five Trust Service Criteria, continuously monitors your controls for drift, and uses AI to predict your audit readiness score before you schedule the audit. Most customers achieve SOC 2 readiness in 8–12 weeks versus the industry average of 6–9 months.