An enterprise customer or a US partner asked for a SOC 2 report. Readiness is the work before the audit.
SOC 2 readiness is the work before the audit. Sorami selects the Trust Services Criteria that apply, runs a gap assessment against them, and builds the evidence index the auditor will ask for. The report itself is issued by a licensed CPA firm, which Sorami is not, and most contracts asking for a SOC 2 report mean Type II.
Twenty questions across the common Trust Services Criteria. Answer no if you cannot show an auditor the evidence today.
20 questions. Answer them all and your score appears here.
Nothing is sent anywhere. The scoring runs in your browser.
Self-assessment. Not an audit opinion.
If the result is useful, send us the answers and we will scope against them.
Want to send this to a colleague? It has its own page: the SOC 2 readiness self-check, with the scoring bands explained.
The 2017 AICPA Trust Services Criteria with revised points of focus, 2022. Security is the only required category, and the 33 common criteria sit across CC1 to CC9. The rows below are the ones that generate the most evidence work.
| Reference | What it requires | What readiness produces |
|---|---|---|
| CC6.1 | Logical access security software, infrastructure and architectures | Access model, and the configuration that enforces it. |
| CC6.2 | Registration and authorisation before credentials are issued | An approval record per account. Auditors sample joiners and leavers. |
| CC6.3 | Role-based access, least privilege and segregation of duties | Quarterly access reviews with the decisions retained. |
| CC6.6 | Protection against threats from outside the system boundary | Where a penetration test report becomes evidence. |
| CC7.1 | Detection of configuration changes and new vulnerabilities | Scan output with an owner and a remediation record. |
| CC7.2 | Monitoring system components for anomalies | Alerting that demonstrably reached a person. |
| CC7.4 | Response to identified security incidents | An incident response programme, exercised. |
| CC8.1 | Change management | Review, test and approval evidence for production changes. |
| CC9.2 | Vendor and business partner risk management | Subservice organisation reports you actually read. |
Source. AICPA Trust Services Criteria. Identifiers verified against the primary source, not quoted from a summary.
Category selection changes the criteria in scope. Adding Availability or Confidentiality adds criteria and adds evidence, so the selection decision comes before any tooling decision. Sorami does not attest. A licensed CPA firm issues the report.
| Control area | Evidence an auditor accepts |
|---|---|
| Access control | Quarterly access review export, signed. Joiner and leaver tickets with dates. |
| Authentication | Identity provider policy screenshot showing MFA enforcement and the exception list. |
| Change management | Pull request history with reviewer, plus the deployment record for a sampled change. |
| Vulnerability management | Dependency scan output, the triage decision and the remediation ticket. |
| Penetration testing | Report with dates and scope, and the retest record for the findings raised. |
| Logging and monitoring | Retention configuration, one alert that fired, and the response it triggered. |
| Incident response | The plan, the last exercise notes, and any real incident record for the period. |
| Backup and recovery | A restore test with the date, the operator and the outcome. |
| Vendor management | Vendor inventory, criticality rating and the subservice report you reviewed. |
| People | Training completion export and policy acceptance records for the period. |
Extract. The full index is built against your selected criteria during the engagement.
Deciding between the two report types first? Read SOC 2 Type I vs Type II. For running the controls after readiness closes, see the vCISO retainer. Not sure how far off you are? Take the two minute self-check at the top of this page.
No. Sorami has not undergone a SOC 2 audit and cannot issue a SOC 2 report. Only a licensed CPA firm can attest.
Type I is a point-in-time design check and usually unblocks the deal. Type II covers three to twelve months of operation. Read the contract wording before choosing.
Not always. A tool speeds evidence collection. It does not decide scope or close a control gap.
No. We prepare you and liaise with the auditor you select. Doing both would defeat the point.
Send the requester wording and your deadline. We will confirm scope and fee before any work starts.
Last reviewed: