Home / Resources / SOC 2 readiness self-check

Are you ready for a SOC 2 audit?

Twenty questions across the Trust Services Criteria, scored in your browser. Nothing is sent anywhere and no email is asked for.

Sorami Consulting built this self-check to answer one question before anyone books an auditor: can you show the evidence today. Twenty questions, scored in your browser, in about two minutes. A low score is not a failure. It is the distance, and the distance is what decides whether you need a gap assessment first or can go straight to readiness.

Score yourself first

How ready you actually are

Twenty questions across the common Trust Services Criteria. Answer no if you cannot show an auditor the evidence today.

Scope and governance

Have you decided which Trust Services Criteria are in scope, beyond Security?

Is the system description limited to the product your customer buys?

Does someone own each control by name rather than by team?

Has a risk assessment been done in the last 12 months?

Access control

Is multi-factor authentication enforced on every production and administrative path?

Are user access reviews performed and recorded at least quarterly?

Is access revoked within one business day of someone leaving?

Are production credentials held in a secrets manager rather than in code or a spreadsheet?

Change and development

Does every production change go through review and leave a record?

Is there a separate environment for testing before production?

Are vulnerabilities in dependencies tracked with an owner and a due date?

Has a penetration test been run in the last 12 months?

Monitoring and response

Are security-relevant logs centralised and retained for at least a year?

Do alerts reach a person who is on the hook to respond?

Is there an incident response plan that has been exercised, not just written?

Do you notify affected customers on a defined timeline?

Vendors, people and evidence

Do you review subservice organisation reports for your critical vendors?

Do staff complete security training and accept policies on a recorded schedule?

Are backups tested by restoring, not just by checking the job succeeded?

Could you produce a year of evidence for any control without a scramble?

20 questions. Answer them all and your score appears here.

Nothing is sent anywhere. The scoring runs in your browser.

Self-assessment. Not an audit opinion.

If the result is useful, send us the answers and we will scope against them.

How it is scored

What each band means.

  • 0 to 7 yes. Scope and criteria are not settled yet.
  • 8 to 14 yes. A readiness engagement fits.
  • 15 to 20 yes. You may be ready to select an auditor.

In the lowest band a gap assessment tells you the distance before anyone books an auditor. In the middle band the controls mostly exist and the work left is evidence, owners and policy. In the top band, confirm the evidence index against your selected criteria, then approach a licensed CPA firm.

Scoring runs in your browser. Nothing is sent anywhere, no email is asked for, and there is no follow-up unless you start one.

Source. Questions are written against the AICPA Trust Services Criteria. The wording is ours; the criteria are the AICPA's.

What this is not

The limits of a self-assessment

  • A self-assessment, not an audit opinion.
  • Only a licensed CPA firm can attest to SOC 2.
  • It asks what you can evidence today, not what exists in principle.
  • It covers the common criteria. Your selected criteria may be wider.

A high score does not mean an auditor will accept your evidence. It means the conversation is worth having.

Questions before you book

Practical answers.

Is this a SOC 2 audit?

No. It is a self-assessment you score yourself, in your browser. Only a licensed CPA firm can perform a SOC 2 examination and issue an opinion. Sorami is not a CPA firm and is not SOC 2 audited.

What does a low score mean?

It means the evidence is not there yet, which is the normal starting point. The score tells you the distance, and the distance is what decides whether you need a gap assessment first or can go straight to readiness.

Which criteria does it cover?

The common criteria most organisations are asked for, the ones that drive the evidence requests. Your scope is wider than these twenty questions if your customer has also named Availability, Confidentiality, Processing Integrity or Privacy.

Is anything sent to Sorami?

No. The scoring runs in your browser and your answers stay on your device. If you want them looked at, you send them yourself.

If the result says the work is bigger than an afternoon, the SOC 2 readiness page sets out what an engagement actually covers. The other self-check is the Essential Eight Maturity Level 2 self-check, and every free artefact is listed on resources.

Let’s scope it

Want the answers looked at?

Send us your yes and no answers with the deadline you are working to. We will tell you what the distance means and what it would take to close it.

Request a quote

Last reviewed: