SOC 2 Compliance Checklist: A Practical Guide for US Businesses
A solid SOC 2 compliance checklist keeps your audit on schedule and your costs predictable. SOC 2 is the attestation report US customers increasingly demand before they sign a contract with a technology or service provider. This guide walks through scoping, controls, evidence, and audit steps in the order you should do them.
Note: this article is general information, not legal or audit advice. Confirm requirements with your CPA firm.
Author Experience Note
This guide reflects the kind of readiness work IT teams commonly perform when preparing small and mid-sized organizations for SOC 2 examinations: mapping systems, writing policies, configuring access controls, and assembling evidence. Final attestation can only be issued by a licensed CPA firm, and your auditor's requirements always take precedence over any checklist.
What SOC 2 Is and Who Needs It
SOC 2 is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how a service organization protects customer data against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
SOC 2 is not a law. It is a market requirement. SaaS vendors, managed service providers, data centers, and fintech and health tech companies are routinely asked for a report during vendor security reviews.
Type I vs. Type II
- Type I: Tests whether controls are designed appropriately at a single point in time.
- Type II: Tests whether controls operated effectively over a period, commonly 3 to 12 months.
Most enterprise buyers prefer Type II because it shows sustained behavior, not a snapshot.
Why It Matters: The US Risk Landscape
The FBI's Internet Crime Complaint Center (IC3) reported more than $12.5 billion in losses from complaints in its 2023 Internet Crime Report. IBM's 2024 Cost of a Data Breach Report put the average US breach cost at roughly $9.36 million. Verify current figures at the source before publishing or citing them, since both reports are updated annually.
On the regulatory side, SOC 2 helps support obligations under laws and rules such as the FTC Act, the HIPAA Security Rule (administered by HHS), the Gramm-Leach-Bliley Act Safeguards Rule, and state privacy laws like the California Consumer Privacy Act. A SOC 2 report does not equal compliance with any of these, but its controls overlap heavily with them.
NIST frameworks, including the Cybersecurity Framework 2.0 and SP 800-53, are useful reference points when you map controls. You can find them on the National Institute of Standards and Technology website.
The SOC 2 Compliance Checklist: 10 Steps
1. Define Your Scope
List the systems, applications, infrastructure, people, vendors, and data that support the services you are reporting on. Tight scope lowers cost. Document system boundaries with a simple diagram.
2. Choose Your Trust Services Criteria
Security (called the Common Criteria) is mandatory. Add Availability, Confidentiality, Processing Integrity, or Privacy only if customers need them or your service promises them.
3. Run a Gap Assessment
Compare current practices against each criterion. Record gaps, owners, and target dates. This becomes your remediation plan.
4. Write Core Policies
Auditors expect approved, current, and communicated policies. At minimum, cover:
- Information security policy
- Access control and least privilege
- Acceptable use
- Change management
- Incident response
- Business continuity and disaster recovery
- Vendor management
- Data retention and disposal
5. Perform a Formal Risk Assessment
Identify threats, rate likelihood and impact, and document treatment decisions. Repeat at least annually and after major changes.
6. Implement Technical Controls
- Multi-factor authentication on all production, cloud, and admin accounts
- Role-based access with quarterly access reviews
- Encryption in transit and at rest
- Centralized logging and alerting
- Vulnerability scanning and timely patching
- Endpoint protection and device management
- Tested, immutable backups
7. Formalize People Processes
Run background checks where lawful, require signed confidentiality agreements, deliver security awareness training at onboarding and annually, and document offboarding with same-day access removal.
8. Control Change and Vendors
Require peer review and approval for code and infrastructure changes. Keep an inventory of vendors, assess their risk, and collect their SOC reports or security attestations.
9. Collect Evidence Continuously
For a Type II, auditors sample evidence across the whole period. Save screenshots, tickets, logs, training records, and review sign-offs as they happen. Compliance automation platforms can help, but they do not replace sound processes.
10. Select an Auditor and Complete the Audit
Choose a licensed CPA firm with experience in your industry. Schedule a readiness review, confirm the observation window, and assign one person to coordinate requests. After fieldwork, you receive the report with the auditor's opinion.
Common SOC 2 Mistakes to Avoid
- Over-scoping: Including systems that do not touch customer data.
- Policy-only compliance: Writing policies nobody follows.
- Missing evidence: A control that cannot be proven did not happen, as far as an auditor is concerned.
- Ignoring vendors: Subservice organizations must be addressed in your report.
- Treating it as one-time: Reports are typically renewed every 12 months.
Realistic Timeline and Cost
Many small and mid-sized companies need roughly 3 to 6 months of preparation, followed by a Type II observation period. Audit fees vary widely by scope, firm, and company size, so get at least two quotes. Budget internal staff time as well, which is often the largest hidden cost.
Where IT Support Fits In
Much of the checklist is operational IT work: identity management, patching, logging, backups, and endpoint security. If your team lacks capacity, a partner offering managed IT and cybersecurity services can implement and monitor these controls so evidence is produced as part of daily operations.
SOC 2 Compliance Checklist FAQ
What is a SOC 2 compliance checklist?
A SOC 2 compliance checklist is a step-by-step list of tasks to prepare for a SOC 2 audit. It covers scoping, selecting Trust Services Criteria, writing policies, implementing controls, collecting evidence, and engaging a CPA auditor.
How long does it take to become SOC 2 compliant?
Preparation typically takes 3 to 6 months, depending on your existing controls. A Type I report can follow soon after. A Type II report requires an observation period, commonly 3 to 12 months, before the audit concludes.
Is SOC 2 legally required?
No. SOC 2 is a voluntary attestation, not a federal or state law. However, customers often require it contractually, and its controls can support compliance with laws such as HIPAA and the GLBA Safeguards Rule.
What is the difference between SOC 2 Type I and Type II?
Type I evaluates whether controls are suitably designed at one point in time. Type II evaluates whether those controls operated effectively over a defined period, which gives customers stronger assurance.
Which Trust Services Criteria are required?
Only Security is required. Availability, Processing Integrity, Confidentiality, and Privacy are optional and should be included based on customer expectations and the commitments you make about your service.
Conclusion: Start With Scope and Evidence
Passing a SOC 2 audit comes down to disciplined scoping, working controls, and consistent evidence. Use this checklist to run a gap assessment this week, assign owners to each step, and book your auditor early.
Need help turning the checklist into working controls? Contact TangentTek today to plan your SOC 2 readiness.
