Free Checklist

The SOC 2 Compliance Checklist

Most SOC 2 timelines slip in the same two places: a scope decided too late to change cheaply, and an observation window that starts before the controls actually operate. This checklist walks all six phases in order, from scoping the report through to what happens after it lands, with the decisions each phase has to close out before the next one starts.

• Scoping the report: Type I or Type II, which criteria, which systems
• Governance and the Common Criteria, with the readiness gap assessment that follows
• Operating the observation window so the evidence is there when fieldwork begins
• Audit fieldwork, the post-report motion, and where teams lose the most time