Readiness screening · about 4 to 6 minutes

SOC 2 preparation

Make your evidence useful before the examination. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original preparation prompts. Not a Trust Services Criteria catalogue, CPA examination, attestation or SOC 2 compliance percentage. Reference: AICPA SOC resources (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Boundary

Are the service and system boundary clearly described?
Are customer commitments translated into responsibilities?
Have examination scope and timing been discussed with a CPA firm?

Operation

Are access approvals and removals consistently recorded?
Are production changes reviewed and attributable?
Are incidents, vulnerabilities and vendor issues followed through?

Evidence

Can you retrieve evidence for the relevant time period?
Do evidence references identify their scope and source?
Are sensitive records shared through an approved channel?

Review

Are control owners reviewing exceptions?
Has management reviewed the proposed system description?
Are open readiness gaps prioritized before the examination?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the SOC 2 preparation assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · Cloud & identity · AI & agent security · SOC & incident readiness · Small business security · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness