There is no official SOC 2 checklist. A CPA firm's article, updated on 5 November 2025, says the AICPA "has not issued a SOC 2 compliance checklist that contains the requirements," and that every other checklist is "just suggestions." The AICPA's 2017 Trust Services Criteria with revised points of focus (2022) are still the criteria in force in 2026, and the Security category is built from nine series, CC1 to CC9. This checklist follows those series, so each item traces back to criteria text and not to someone's opinion of what auditors want.
What's affected
Any company preparing for a first SOC 2 Type 1 or Type 2 on the Security category. If you add Availability or Confidentiality, extra criteria apply, and the scoping decision is covered in a separate post on categories and system scope. The same CPA firm calls a readiness assessment "a practice run or dress rehearsal for the actual SOC 2 audit itself," and this checklist is a self-run version of that.
How to check if you're exposed
Score each row yes, partly or no. Every "no" is a remediation item, and every "partly" is where an exception will likely come from.
| Series | What the criteria ask | Question the auditor will ask | Evidence to have ready |
|---|---|---|---|
| CC1 Control environment | Commitment to integrity and ethics, oversight, structure, competent people, accountability (CC1.1 to CC1.5) | Who owns security, and how do you check people before and after hire? | Org chart, code of conduct acknowledgments, background check records, training records |
| CC2 Communication | Quality information, internal and external communication (CC2.1 to CC2.3) | How do staff and customers learn about responsibilities and incidents? | Policy distribution records, security contact page, customer notification procedure |
| CC3 Risk assessment | Clear objectives, risk identification and analysis, fraud risk, change risk (CC3.1 to CC3.4) | Show the risk assessment and what you did with it | Dated risk register with owners and treatments, review notes |
| CC4 Monitoring | Ongoing evaluation, timely communication of deficiencies (CC4.1, CC4.2) | How do you know a control stopped working? | Internal control checks, deficiency log, management review minutes |
| CC5 Control activities | Controls that mitigate risk, technology controls, policies and procedures (CC5.1 to CC5.3) | Do your procedures match your policies? | Approved policies, runbooks, acknowledgments |
| CC6 Access | Logical access, provisioning, removal, physical access, disposal, boundary protection, data movement, malware (CC6.1 to CC6.8) | Who has access to production, and how does it change? | User lists, approval tickets, termination reconciliation, review records, MFA settings |
| CC7 System operations | Vulnerability detection, anomaly monitoring, event evaluation, incident response, recovery (CC7.1 to CC7.5) | How do you find and fix vulnerabilities and handle incidents? | Scan results, remediation tickets, alert logs, incident records, a tested plan |
| CC8 Change management | Authorized, tested, approved changes to infrastructure, data, software and procedures (CC8.1) | Show me the last ten production changes | Pull requests, reviews, approvals, deploy records |
| CC9 Risk mitigation | Disruption planning, vendor risk (CC9.1, CC9.2) | Which vendors matter, and how do you monitor them? | Vendor register, vendor reports reviewed, continuity plan |
What to do now
- Run the table as a one hour workshop with engineering, people operations and whoever signs contracts. Mark yes, partly or no for every row.
- For each "partly" or "no," create one ticket with an owner and a date. Fix design gaps before any observation window opens.
- For CC7.1, which asks for detection of "susceptibilities to newly discovered vulnerabilities," prove you look at your dependencies. A free in-browser scan at gold.safeguard.sh/scan accepts a package.json, requirements.txt, CycloneDX or SPDX file, keeps the file on your machine, needs no login and covers up to 100 dependencies per scan.
- For CC7.4, run a tabletop exercise on one realistic incident and write up the timeline, containment, communication and follow-up. The criterion asks for a "defined incident-response program to understand, contain, remediate, and communicate security incidents."
- For CC8.1, turn on required reviews on the main branch of every in-scope repository so that approvals are produced as a side effect of working.
- Build the evidence calendar from the post on evidence and sampling, and start it before the window.
- Ask a CPA firm for a readiness assessment against the same table. A different set of eyes finds the rows you marked "yes" too generously.
How to avoid this trap
- Do not treat a checklist as a deliverable. The criteria are about operation over time, not about having a document.
- Do not mark a row "yes" because a tool shows a green tick. Check that the control produces evidence you could hand over today.
- Do not leave CC3 for the last week. A risk assessment needs the right people in the room, and one CPA firm notes that an assessment done only by the IT department missed business-level risks.
- Do not skip CC4. Controls that nobody checks between audits break quietly. The same firm notes that both manual and automated controls are prone to breakdown.
Why it matters
Auditors work from the same criteria text you can read. A checklist that mirrors it removes surprises. It also helps with the customer who asked for the report in the first place. Their questionnaire is a compressed version of the same table, and every "yes" you can evidence shortens the next questionnaire.
The February 2026 Journal of Accountancy article on quick-turn SOC engagements advised customers to ask whether a report reflects the service's specific risks. A readiness table you filled in yourself is the best preparation for that question, because your answers are specific to your system.
Try it yourself
Print the table. Take ten minutes per row and write the name of the person who would produce the evidence. Any row where you write "not sure" is where to start.
Click through it at your own pace, or open it full screen.
Quick check
Does the AICPA publish an official SOC 2 checklist?
No. According to a CPA firm's guidance, the AICPA has not issued a SOC 2 compliance checklist containing the requirements. The Trust Services Criteria are the source, and any checklist is an interpretation.
What is the CC series in SOC 2?
The common criteria, CC1 to CC9, which together make up the Security category. They cover the control environment, communication, risk assessment, monitoring, control activities, access, system operations, change management and risk mitigation.
Which criterion covers vendor risk?
CC9.2: the entity assesses and manages risks associated with vendors and business partners.
Sources
- AICPA: 2017 Trust Services Criteria with revised points of focus (2022)
- Linford and Company: SOC 2 compliance checklist reality (5 November 2025)
- Linford and Company: SOC 2 risk assessment, what auditors look for (14 January 2026)
- Linford and Company: SOC audit failure, common mistakes (2 April 2025)
- Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
- Free dependency scan
