SOC 2 Type II Readiness Checklist — mapped to every criterion.

Test procedureInspect code of conduct document; verify acknowledgement logs for all employees

Practical example / evidenceCode of conduct document; signed acknowledgement forms

Test procedureReview training completion records; inspect curriculum

Practical example / evidenceLMS completion reports; training materials

Test procedureReview org chart; verify reporting lines

Practical example / evidenceApproved org chart; board resolutions

Test procedureInspect JDs for security requirements; confirm completeness

Practical example / evidenceJob descriptions; RACI matrix

Test procedureSample new hire files; confirm background check completion

Practical example / evidenceBGC reports; vendor invoices

Test procedureInspect onboarding checklist; test access provisioned matches role

Practical example / evidenceOnboarding checklists; provisioning tickets

Test procedureReview appraisal templates for security criteria

Practical example / evidencePerformance review templates

Test procedureInspect disciplinary policy; review enforcement cases

Practical example / evidenceDisciplinary policy; HR case records

Test procedureReview board minutes; inspect security committee charters

Practical example / evidenceBoard/audit committee minutes; committee charter

Test procedureReview KPI dashboards; inspect accountability reports

Practical example / evidenceSecurity dashboards; management reports

Test procedureInspect policy library; check approval dates and version control

Practical example / evidencePolicy documents; approval evidence

Test procedureTest employee acknowledgement records; sample 25 employees

Practical example / evidenceAcknowledgement records; LMS logs

Test procedureInspect communication plan; verify channels are functional

Practical example / evidenceCommunication plan; test incidents

Test procedureInspect external communication policy; review PR/IR guidance

Practical example / evidenceExternal comms policy; NDA templates

Test procedureReview incident comms playbook; inspect past incident notifications

Practical example / evidenceIR plan; incident notification logs

Test procedureReview vendor onboarding docs; inspect security questionnaires

Practical example / evidenceVendor security questionnaires; contracts

Test procedureInspect training schedule; verify completion rates >95%; review phishing test results

Practical example / evidenceLMS reports; phishing simulation results

Test procedureReview classification policy; inspect training completion

Practical example / evidenceClassification policy; training logs

Test procedureReview escalation matrix; test with sample incidents

Practical example / evidenceEscalation matrix; incident tickets

Test procedureInspect document management system; verify version history

Practical example / evidenceDMS exports; change logs

Test procedureReview risk assessment policy; verify board approval

Practical example / evidenceRisk policy; board approval minutes

Test procedureInspect risk register; verify quarterly reviews; assess completeness

Practical example / evidenceRisk register; review meeting minutes

Test procedureReview scoring rubric; recompute 5 sample risks

Practical example / evidenceRisk scoring model; calculation worksheets

Test procedureInspect most recent risk assessment report; verify date and scope

Practical example / evidenceAnnual risk assessment report

Test procedureReview threat models for top 3 systems; verify completeness

Practical example / evidenceSTRIDE/PASTA threat models; review evidence

Test procedureInspect fraud risk assessment; verify linkage to controls

Practical example / evidenceFraud risk assessment; control mapping

Test procedureReview BIA document; verify RTOs/RPOs are defined

Practical example / evidenceBIA report; RTO/RPO documentation

Test procedureReview threat intelligence feeds; inspect emerging risk log

Practical example / evidenceThreat intel reports; risk register updates

Test procedureSample 10 change requests; verify risk assessment field completed

Practical example / evidenceChange request tickets; CAB minutes

Test procedureReview third-party risk register; verify tiering methodology

Practical example / evidenceVendor risk register; tiering criteria

Test procedureInspect treatment plans; verify owner and due date for each risk

Practical example / evidenceRisk treatment plans; tracking dashboard

Test procedureReview residual risk approval records; verify appropriate authority

Practical example / evidenceResidual risk sign-offs; board minutes

Test procedureReview IA charter and annual audit plan; inspect completed audits

Practical example / evidenceIA charter; audit plan; reports

Test procedureInspect monitoring tool configurations; review alert thresholds

Practical example / evidenceTool configs; alert definitions; dashboards

Test procedureInspect review schedule; verify completion and findings tracked

Practical example / evidenceControl testing workpapers; review calendar

Test procedureReview exception log; verify all exceptions have owners and close dates

Practical example / evidenceException register; resolution evidence

Test procedureReview KPI dashboard; inspect trend data for 3 months

Practical example / evidenceKPI dashboard; trend reports

Test procedureInspect compliance tracker; verify coverage of all obligations

Practical example / evidenceCompliance tracker; regulatory mappings

Test procedureReview scan configurations; inspect last 4 scan reports; verify remediation SLAs

Practical example / evidenceVulnerability scan reports; remediation tickets

Test procedureInspect SIEM log sources; verify retention periods meet policy; test log query

Practical example / evidenceSIEM configuration; retention policy; test queries

Test procedureReview SIEM alert queue; inspect mean-time-to-respond metrics; sample 5 alerts

Practical example / evidenceSIEM dashboards; SOC analyst tickets

Test procedureInspect audit log review records; verify completeness

Practical example / evidenceAudit log review reports; tickets raised

Test procedureInspect SOP library; verify coverage of key processes

Practical example / evidenceSOP documents; review evidence

Test procedureTest 10 transactions; verify approval chain in system

Practical example / evidenceWorkflow system logs; approval records

Test procedureInspect automated control configurations; test enforcement

Practical example / evidenceSystem config screenshots; test results

Test procedureSample 10 manual control executions; verify evidence

Practical example / evidenceManual control logs; sign-off records

Test procedureReview exception approval log; verify senior approval

Practical example / evidenceException approval records; tickets

Test procedureInspect enforcement mechanisms; test 5 scenarios

Practical example / evidencePolicy enforcement logs; test evidence

Test procedureRun SoD conflict report; verify remediation of conflicts

Practical example / evidenceSoD reports; conflict remediation records

Test procedureInspect control review workpapers; verify scope and outcomes

Practical example / evidenceControl review reports; action items

Test procedureReview configuration management tool; compare settings to CIS benchmarks

Practical example / evidenceConfig scan reports; CIS benchmark mappings

Test procedureReview control testing workpapers; verify DoE and DoOE

Practical example / evidenceTesting workpapers; auditor findings

Test procedureInspect compliance testing results; map to requirements

Practical example / evidenceCompliance test reports; regulatory mapping

Test procedureInspect DMS settings; verify access restrictions on sensitive docs

Practical example / evidenceDMS access logs; permission settings

Test procedureSample 15 provisioning requests; verify manager approval and role justification

Practical example / evidenceIAM tickets; approval records

Test procedureReview RBAC matrix; test 5 accounts for excessive access

Practical example / evidenceRBAC matrix; access review reports

Test procedureInspect MFA policy; test enforcement on 10 accounts; review exception list

Practical example / evidenceMFA config; exception register

Test procedureInspect AD/SSO password policy; verify complexity settings

Practical example / evidencePassword policy config; screenshots

Test procedureInspect PAM tool configuration; test just-in-time access; review privileged account inventory

Practical example / evidencePAM tool config; access logs; inventory

Test procedureInspect access review records; verify manager sign-offs; confirm revocations

Practical example / evidenceAccess review reports; revocation tickets

Test procedureSample 10 terminations; verify access revoked within SLA

Practical example / evidenceHR offboarding records; IAM revocation logs

Test procedureInspect physical security measures; review badge access logs

Practical example / evidenceBadge logs; CCTV evidence; lock reports

Test procedureInspect visitor logs; verify escort policy compliance

Practical example / evidenceVisitor log records; escort policy

Test procedureInspect MDM enrollment; verify encryption status on 10 devices

Practical example / evidenceMDM console; encryption status reports

Test procedureReview firewall rule sets; verify change approval process; check for any/any rules

Practical example / evidenceFirewall configs; change tickets; last review

Test procedureInspect VPN configuration; verify MFA required; review split tunnel settings

Practical example / evidenceVPN config; auth logs

Test procedureInspect encryption standards (TLS 1.2+, AES-256); test certificates; review key management

Practical example / evidenceSSL scan reports; KMS config; certificates

Test procedureVerify EDR coverage; inspect last threat detection report; check update frequency

Practical example / evidenceEDR console; coverage report; threat log

Test procedureInspect AV management console; verify signature currency and scan schedule

Practical example / evidenceAV console; scan reports

Test procedureTest remote access flow; verify MFA and encrypted tunnel

Practical example / evidenceRemote access logs; auth logs

Test procedureReview network diagram; verify VLAN/security group segregation

Practical example / evidenceNetwork diagrams; firewall rule review

Test procedureInspect DLP policy rules; review DLP alert log

Practical example / evidenceDLP config; alert log; test results

Test procedureVerify logging enabled on critical systems; test log query; confirm retention

Practical example / evidenceLogging config; sample log queries; retention settings

Test procedureReview zero trust design; inspect microsegmentation; verify identity verification

Practical example / evidenceArchitecture diagrams; policy enforcement logs

Test procedureInspect IdP configuration; review federated trust relationships; verify SAML/OIDC setup

Practical example / evidenceIdP config; trust list; authentication logs

Test procedureTest session timeout on critical applications; verify policy settings

Practical example / evidenceSession policy config; test evidence

Test procedureReview incident management policy; inspect IR process flowchart

Practical example / evidenceIR policy; process diagrams

Test procedureInspect IRP; verify annual review and tabletop exercise conducted

Practical example / evidenceIRP document; tabletop exercise report

Test procedureInspect incident log; verify completeness; sample 10 incidents

Practical example / evidenceIncident tickets; SIEM alerts

Test procedureReview RCA reports; verify corrective actions tracked to closure

Practical example / evidenceRCA reports; action tracking

Test procedureInspect patch policy; review last 3 patch cycles; verify critical patch SLA compliance

Practical example / evidencePatch management reports; WSUS/JAMF logs

Test procedureReview vulnerability management SOP; inspect remediation SLA compliance

Practical example / evidenceVuln scan reports; remediation tracker

Test procedureInspect backup monitoring dashboard; review alert history; verify test restores

Practical example / evidenceBackup logs; restore test records; alerts

Test procedureReview recovery runbooks; inspect DR test results

Practical example / evidenceDR runbooks; DR test reports

Test procedureReview SLA dashboard; inspect monthly reports; verify breach escalation

Practical example / evidenceSLA reports; escalation records

Test procedureInspect scheduler configuration; review failure alert settings; sample job logs

Practical example / evidenceScheduler config; job logs; alert history

Test procedureReview alerting configuration; inspect alert response history

Practical example / evidenceMonitoring tool config; alert response logs

Test procedureInspect dashboards; verify coverage of critical systems

Practical example / evidenceDashboard screenshots; metric definitions

Test procedureInspect change management policy; review ITSM change module

Practical example / evidenceChange policy; ITSM screenshots

Test procedureSample 15 change records; verify CAB approval for standard/major changes

Practical example / evidenceCAB minutes; change tickets

Test procedureSample 10 deployments; verify test evidence attached

Practical example / evidenceTest reports; deploy tickets

Test procedureInspect rollback procedures for major systems; verify tested

Practical example / evidenceRollback runbooks; test evidence

Test procedureSample emergency changes; verify post-implementation review

Practical example / evidenceEmergency change records; PIR reports

Test procedureInspect VCS configuration; verify branching policy; check commit signing

Practical example / evidenceVCS config; branch policies; commit logs

Test procedureInspect deployment pipeline; verify logs captured per deployment

Practical example / evidenceCI/CD logs; deployment records

Test procedureInspect environment architecture; verify no cross-env access

Practical example / evidenceArchitecture diagrams; IAM policies

Test procedureReview vendor risk program; inspect vendor inventory

Practical example / evidenceVendor risk policy; vendor inventory

Test procedureSample 5 vendor assessments; verify questionnaire completeness and risk rating

Practical example / evidenceVendor questionnaires; assessment reports

Test procedureReview 5 vendor contracts; verify security SLAs

Practical example / evidenceVendor contracts; SLA schedules

Test procedureReview contract templates; inspect security clause library

Practical example / evidenceContract templates; legal review records

Test procedureReview DPAs for top 10 data processors; verify adequacy

Practical example / evidenceDPAs; processor register

Test procedureInspect vendor scorecard; review quarterly review records

Practical example / evidenceVendor scorecards; review meeting minutes

Test procedureReview vendor action tracker; verify closed items

Practical example / evidenceVendor action tracker; evidence of closure

Test procedureInspect vendor exit procedures; sample a completed offboarding

Practical example / evidenceVendor exit playbook; completed offboarding records

Test procedureReview capacity plan; inspect utilization reports; verify alerts at 80%

Practical example / evidenceCapacity reports; threshold alert configs

Test procedureInspect APM tool; review last 90 days performance data; verify alerting

Practical example / evidenceAPM dashboard; SLA reports

Test procedureInspect backup policy; review backup job logs for 30 days; verify offsite/offline copy

Practical example / evidenceBackup logs; offsite replication config

Test procedureReview DRP; verify RTOs/RPOs defined per BIA; check annual review date

Practical example / evidenceDRP document; BIA cross-reference

Test procedureInspect DR test report; verify RTO/RPO achieved; review lessons learned

Practical example / evidenceDR test plan; test results; lessons learned

Test procedureTest failover configuration; verify auto-failover triggers

Practical example / evidenceFailover test reports; config screenshots

Test procedureReview architecture for critical systems; verify N+1 or higher redundancy

Practical example / evidenceArchitecture diagrams; redundancy matrix

Test procedureInspect uptime monitoring tool; review 90-day availability report

Practical example / evidenceUptime tool config; availability reports

Test procedureReview SLA compliance report; verify breach escalation process

Practical example / evidenceSLA compliance reports; breach records

Test procedureSample 5 availability incidents; verify timely communication to stakeholders

Practical example / evidenceIncident reports; customer notifications

Test procedureReview classification policy; inspect data inventory for classification tags

Practical example / evidenceClassification policy; data inventory

Test procedureInspect storage encryption settings; verify key management

Practical example / evidenceStorage encryption config; KMS settings

Test procedureRun SSL Labs / TLS scan; verify TLS 1.2+ on all endpoints; check certificate expiry

Practical example / evidenceTLS scan reports; certificate inventory

Test procedureReview data disposal policy; inspect disposal records; verify certificate of destruction

Practical example / evidenceDisposal records; DoD wipe certificates

Test procedureReview access control list for confidential data stores; test unauthorized access attempts

Practical example / evidenceACL reports; access test evidence

Test procedureTest 10 input scenarios including invalid/boundary values; verify rejection logic

Practical example / evidenceTest scripts; QA results

Test procedureInspect unit and integration tests; verify coverage of critical calculations

Practical example / evidenceTest coverage reports; test results

Test procedureSample 10 system outputs; verify against expected values

Practical example / evidenceOutput reconciliation reports

Test procedureInspect error handling code; verify error logging; test error scenarios

Practical example / evidenceCode review evidence; error logs

Test procedureInspect reconciliation reports; verify discrepancy investigation process

Practical example / evidenceReconciliation reports; investigation records

Test procedureInspect transaction log configuration; sample log entries; verify immutability

Practical example / evidenceTransaction logs; log config

Test procedureInspect batch control reports; verify record counts match source

Practical example / evidenceBatch reports; control totals

Test procedureTest authorization checks; attempt unauthorized transactions

Practical example / evidenceTest scripts; access control matrix

Test procedureInspect completeness verification logic; review exception reports

Practical example / evidenceCompleteness reports; exception logs

Test procedureInspect processing dashboards; verify alert thresholds

Practical example / evidenceDashboard screenshots; alert config

Test procedureInspect privacy policy; verify accessible on website; check review date

Practical example / evidencePrivacy policy; publication evidence

Test procedureInspect consent management platform; verify opt-in/opt-out flows

Practical example / evidenceConsent tool config; consent records

Test procedureReview retention schedule; inspect automated deletion jobs; sample deletions

Practical example / evidenceRetention policy; deletion logs

Test procedureReview data collection forms; verify alignment with stated purpose

Practical example / evidenceData flow diagrams; PIA reports

Test procedureInspect DSAR process; sample 5 requests; verify response times

Practical example / evidenceDSAR log; response records

Test procedureReview third-party sharing register; inspect DPAs

Practical example / evidenceSharing register; DPAs; data flow maps

Test procedureReview PIA register; sample 3 PIAs; verify completeness

Practical example / evidencePIA register; completed PIAs

Test procedureInspect cookie consent banner; review cookie audit results

Practical example / evidenceCookie audit report; consent configuration

Test procedureReview breach notification SOP; inspect past notifications (if any)

Practical example / evidenceBreach notification SOP; authority notifications

Test procedureReview technical controls mapped to personal data assets

Practical example / evidenceTechnical control inventory; data asset map

Test procedureInspect anonymization techniques; test re-identification risk

Practical example / evidenceAnonymization documentation; test results

Test procedureReview privacy training curriculum; inspect completion rates

Practical example / evidenceLMS reports; training materials

Test procedureConfirm the agreed observation-period start and end dates in writing with your auditor.

Practical example / evidenceEngagement letter or scoping document naming the observation-period start and end dates

Test procedureCheck whether evidence (access logs, change tickets, review records) is captured continuously or only when someone remembers.

Practical example / evidenceAutomated evidence-collection tooling output, or a documented recurring evidence-capture schedule with assigned owners

Test procedureConfirm the engagement letter and observation-period start date are signed before the window begins.

Practical example / evidenceSigned audit engagement letter naming the Trust Services Criteria in scope and the observation period dates