# SOC 2 Compliance Checklist: 24 Steps **URL:** https://theauditrail.com/frameworks/soc-2/checklist/ **Published:** 2026-10-06 **Modified:** 2026-10-11 **Author:** The Audit Trail editorial desk > SOC 2 compliance checklist in 24 steps and eight phases. From scoping Security to the signed report. --- [SOC 2 guide](https://theauditrail.com/frameworks/soc-2/) # SOC 2 Compliance Checklist: 24 Steps in 8 Phases The SOC 2 compliance checklist in 24 steps and eight phases, from scoping the Security criteria to the signed report, with Type 1 and Type 2 timelines. The Audit Trail editorial desk Updated Oct 11, 2026 · First published Oct 6, 2026 [Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.](https://theauditrail.com/how-we-make-money/) In brief - A SOC 2 checklist runs eight phases, from scope to the final report. - Security is the one criteria category every SOC 2 must include. - Linford and Co says the AICPA has issued no checklist. - A Type 2 observation window runs 3 to 12 months. - Software automates evidence, policies and vendor risk, and a CPA firm does the audit. A SOC 2 compliance checklist has eight phases: scope, gap assessment, policies, controls, evidence, auditor selection, the audit window and the report. Security is the one criteria category every SOC 2 must include, and its common criteria run from CC1 to CC9. Availability, Confidentiality, Processing Integrity and Privacy join only when customers need them. Linford and Co, a licensed CPA firm, says the AICPA has issued no SOC 2 checklist and that “all other checklists are just suggestions for meeting the SOC 2 criteria.” The 24 steps below follow the order a first SOC 2 usually takes. ## Type 1 and Type 2 timelines A Type 1 report covers whether controls are designed well on one as-of date. A Type 2 report adds an observation window of 3 to 12 months that tests whether the controls ran. [Scrut](https://theauditrail.com/vendors/scrut/) puts a first SOC 2 at 3 to 6 months for Type 1 and 6 to 12 months for Type 2. Fieldwork length differs by source: [Vanta](https://theauditrail.com/vendors/vanta/) gives 2 to 4 weeks for Type 1 and 1 to 3 weeks for Type 2, and Scrut gives 2 to 5 weeks for both. ![Two-column timeline comparing SOC 2 Type 1 and Type 2: preparation 1 to 3 months, an observation window of 3 to 12 months for Type 2 only, fieldwork 2 to 5 weeks and the report 2 to 6 weeks](https://theauditrail.com/img/soc-2-checklist/soc-2-type-1-vs-type-2-timeline.svg) _Phase durations from Scrut’s published SOC 2 timeline. Linford and Co and BARR Advisory also give a 3 to 12 month Type 2 window._ Scrut says a Type 1 suits controls that are newly implemented. Linford and Co says a Type 1 can be done within a couple of months when few control gaps exist, while a first Type 2 waits out the full period, typically 6 to 12 months. Scrut also says a company whose controls have run for 3 months or more with evidence on file can [go straight to a Type 2](https://theauditrail.com/frameworks/soc-2/for-startups/) with a 3-month window, and that a customer who asks for a Type 2 will not accept a Type 1. ## The SOC 2 audit checklist, step by step ### Phase 1: Scope Scope sets the cost and length of everything after it. BARR says that “If you’re adding too much, it could cost time, while too few criteria may result in more questions from customers or not remediating the right controls.” 1. Choose a report type: Type 1 covers design on one date, and Type 2 covers design and operation over a period of 3 to 12 months ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/)). 2. Put Security in scope, because it is the only category every SOC 2 must include ([A-LIGN](https://www.a-lign.com/articles/what-are-the-soc-2-trust-services-criteria)). 3. Add Availability for uptime commitments, Confidentiality for NDA-protected data, Processing Integrity for financial or data processing, and Privacy for personal information ([A-LIGN](https://www.a-lign.com/articles/what-are-the-soc-2-trust-services-criteria)). 4. Decide which systems process, store or transmit customer data and which sit behind customer commitments, and keep that scope fixed once the audit starts ([BARR Advisory](https://www.barradvisory.com/resource/how-to-prepare-for-your-audit/)). ### Phase 2: Gap assessment A readiness assessment includes no auditor opinion. Schellman says the assessor provides no advisory, remediation or implementation services, so closing the gaps stays with the company. 5. Run a readiness assessment against the criteria, which Linford and Co calls the best practice, since it says the AICPA has issued no checklist ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/)). 6. Allow 2 to 5 business days of planning, about 1 week of walkthroughs and about 1 week to report the gaps in a readiness assessment ([Schellman](https://www.schellman.com/blog/soc-examinations/what-to-expect-soc-2-readiness)). 7. Write a risk assessment that names threats and vulnerabilities and rates the likelihood and impact of each ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). 8. Fix every gap before the as-of date or before the audit period starts. Designate a project manager for the audit ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/), [BARR Advisory](https://www.barradvisory.com/resource/how-to-prepare-for-your-audit/)). ### Phase 3: Policies A-LIGN says policies should align with the Trust Services Criteria and be reviewed and updated as needed. 9. Write and review on a schedule the policies for infrastructure, the service provided, people, access control, data classification, incident response and change management ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). Policy templates are a software category: [Vanta](https://theauditrail.com/vendors/vanta/), [Drata](https://theauditrail.com/vendors/drata/) and [Secureframe](https://theauditrail.com/vendors/secureframe/) each list them. 10. Document the org chart, roles, segregation of duties, the employee handbook and a code of conduct ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). 11. Set hiring rules for background checks and reference checks, plus onboarding training and annual training relevant to each job ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). ### Phase 4: Controls A-LIGN lists five core control areas that most SOC 2 audits evaluate: access controls, logging and monitoring, incident response, vendor management and policy documentation. The steps below add encryption, change management and recovery. 12. Enforce multi-factor authentication and review user access on a schedule ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). BARR places logical and physical access controls in the CC6 series ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). Access reviews are a software category: [Vanta](https://theauditrail.com/vendors/vanta/) lists them and [Drata](https://theauditrail.com/vendors/drata/) sells them as an add-on. 13. Encrypt data at rest and in transit ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). 14. Track and review every change to configuration, software and patches ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist)). BARR places change management in CC8 ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). 15. Run logging and monitoring, and assess on a schedule whether the controls still work ([A-LIGN](https://www.a-lign.com/articles/soc-2-compliance-requirements)). 16. Test an incident response plan and a disaster recovery plan, and keep a record of successful backup restores ([A-LIGN](https://www.a-lign.com/articles/soc-2-checklist), [Drata](https://drata.com/learn/soc-2/checklist)). 17. Assess every vendor with access to systems or data, which covers CC9.2 ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). Four scored vendors reach 5 of 5 on vendor risk management, which is a software category of its own: [Sprinto](https://theauditrail.com/vendors/sprinto/), [Vanta](https://theauditrail.com/vendors/vanta/), [Scrut](https://theauditrail.com/vendors/scrut/) and [OneTrust](https://theauditrail.com/vendors/onetrust/). ### Phase 5: Evidence Linford and Co says a readiness assessment shows the evidence an auditor will request when fieldwork starts. Scrut says periodic controls such as access reviews need one completed cycle inside a Type 2 window, or the auditor cannot test around the gap. 18. Pair each control with proof that it ran, which Vanta puts at snapshots, system descriptions and policy documents for Type 1 and audit logs, access reviews and control test findings for Type 2 ([Vanta](https://www.vanta.com/collection/soc-2/soc-2-compliance-checklist)). Evidence collection is a software category, and [Sprinto](https://theauditrail.com/vendors/sprinto/), [Vanta](https://theauditrail.com/vendors/vanta/) and [Secureframe](https://theauditrail.com/vendors/secureframe/) each earn 5 of 5 on it. 19. Draft the system description and confirm the control wording, because the service organization writes both ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). ![Scrut evidence task dashboard showing 98 of 125 evidences automated, 120 uploaded and 23 evidence gaps](https://theauditrail.com/shots/reviews/scrut/monitoring.webp) _A Scrut sample view of its evidence task screen, counting 98 of 125 evidences automated and listing a quarterly user access review among the gaps._ ### Phase 6: Auditor selection The AICPA tells its members that unlicensed auditors and firms outside peer review face action. 20. Hire a licensed CPA firm, because only licensed CPA firms can issue a SOC report ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/)). Check professional standards, peer review enrollment and licensure, the three criteria the AICPA names ([AICPA](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services)). Of the scored platforms, only [Thoropass](https://theauditrail.com/vendors/thoropass/) runs the audit through its own CPA firm. 21. Ask whether the readiness assessment sits inside the quote or costs extra, since audit fees depend on scope, criteria and company size ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/)). A-LIGN puts audit fees at $20,000 to $150,000 or more, and Scrut counts [$5,000 to $10,000 of internal time](https://theauditrail.com/frameworks/soc-2/cost/) with a platform and $10,000 to $30,000 without one. ### Phase 7: Audit window Scrut says interim testing can begin during a Type 2 window, and sampling for periodic controls happens at or after the end of it. 22. For Type 2, run the controls for the full window: Linford and Co suggests at least 6 months, and [Scrut](https://theauditrail.com/vendors/scrut/) says 3 months captures one quarterly access review ([Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/), [Scrut](https://www.scrut.io/hub/soc-2/soc-2-compliance-timeline)). 23. Answer the auditor’s information requests, which BARR says arrive 60 to 120 days before the period ends, and plan for walkthroughs of about 4 hours ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). ![Vanta audits view with a SOC 2 Type II audit card showing an auditor access date, audit start and end dates and an evidence tracker bar](https://theauditrail.com/shots/reviews/vanta/audit.webp) _A Vanta sample workspace listing a SOC 2 Type II audit with an evidence tracker and three dates: auditor access, audit start and audit end._ ### Phase 8: Report BARR puts the report 30 to 45 days after the period ends, and Scrut puts report delivery at 2 to 6 weeks. 24. Review the draft report and the system description, then sign the management representation letter; BARR delivers its draft within 30 days after the period ends ([BARR Advisory](https://www.barradvisory.com/resource/whats-new-with-soc-2/)). A SOC 2 report is valid for one year after issuance, so the next window needs to start while the first report is current ([BARR Advisory](https://www.barradvisory.com/services/soc-2-compliance/)). Scrut says most organizations move to a 12-month window after the first report to avoid gaps between reports. ## What CC1 to CC9 cover The Security category is built from nine common criteria series. The AICPA revised the points of focus under them in September 2022, and [BARR](https://www.barradvisory.com/resource/whats-new-with-soc-2/) quotes the AICPA saying the revision does “not, in any way, alter the criteria in the 2017 TSC.” Points of focus are guidance, and [Linford and Co](https://linfordco.com/blog/soc-2-compliance-checklist-doesnt-exist/) says they are “not a strict set of requirements.” - **CC1, control environment:** reporting lines and sanctions. - **CC2, communication and information:** asset inventory, information classification, data flow and incident communication. - **CC3, risk assessment:** threats, vulnerabilities, likelihood and impact. - **CC4, monitoring activities:** ongoing and separate evaluations of the controls. - **CC5, control activities.** - **CC6, logical and physical access controls:** infrastructure, types of access, device recovery, IT tools, and system and service accounts. - **CC7, system operations:** incident response plans, and backups with restore tests, according to [Drata](https://drata.com/learn/soc-2/checklist). - **CC8, change management:** testing and implementing changes and software patches. - **CC9, risk mitigation:** risk from vendors and business relationships, which BARR ties to CC9.2. ## What software covers on this checklist Evidence collection scores range from 1 to 5 across the seven scored vendors, and [Sprinto](https://theauditrail.com/vendors/sprinto/), [Vanta](https://theauditrail.com/vendors/vanta/), [Secureframe](https://theauditrail.com/vendors/secureframe/) and OneTrust earn 5 of 5. It is the largest criterion at 20 of 100 points. Vendor risk ranges from 0 to 5: [Sprinto](https://theauditrail.com/vendors/sprinto/), [Vanta](https://theauditrail.com/vendors/vanta/), Scrut and [OneTrust](https://theauditrail.com/vendors/onetrust/) earn 5 of 5, Drata earns 4 and Secureframe earns 2. Trust and questionnaires earn 4 of 5 at six of the seven vendors, and OneTrust earns 0. A licensed CPA firm performs every SOC 2 audit. [Sprinto](https://theauditrail.com/vendors/sprinto/) leads the six-platform [SOC 2 compliance software ranking](https://theauditrail.com/best/soc-2-compliance-software/) at 84, and [Thoropass](https://theauditrail.com/vendors/thoropass/) is last at 52. [Sprinto](https://theauditrail.com/vendors/sprinto/) at 84 and [Vanta](https://theauditrail.com/vendors/vanta/) at 82 score above Drata at 76 among the [Drata alternatives](https://theauditrail.com/best/drata-alternatives/). Sprinto also scores above Vanta among the [Vanta alternatives](https://theauditrail.com/best/vanta-alternatives/). [Compliance automation](https://theauditrail.com/blog/grc/compliance-automation/) tools collect evidence, monitor controls and manage policies, and the [rubric](https://theauditrail.com/rubric/) scores them on evidence, vendor risk and audit path. A [SOC 2](https://theauditrail.com/frameworks/soc-2/) report covers five Trust Services Criteria categories, and only Security is mandatory. Platforms in this article [![Sprinto logo](https://theauditrail.com/logos/sprinto.png)Sprinto (84/100)](/vendors/sprinto/)[ ![Vanta logo](https://theauditrail.com/logos/vanta.png)Vanta (82/100) ](/vendors/vanta/)[ ![Drata logo](https://theauditrail.com/logos/drata.png)Drata (76/100) ](/vendors/drata/)[ ![Secureframe logo](https://theauditrail.com/logos/secureframe.png)Secureframe (75/100) ](/vendors/secureframe/)[ ![Scrut logo](https://theauditrail.com/logos/scrut.png)Scrut (72/100) ](/vendors/scrut/)[ ![OneTrust logo](https://theauditrail.com/logos/onetrust.png)OneTrust (64/100) ](/vendors/onetrust/)[ ![Thoropass logo](https://theauditrail.com/logos/thoropass.png)Thoropass (52/100)](/vendors/thoropass/) ## Frequently asked questions - What is on a SOC 2 compliance checklist? Eight phases: scope, gap assessment, policies, controls, evidence, auditor selection, the audit window and the report. The 24 steps in this checklist run from choosing Type 1 or Type 2 to signing the management representation letter. - Is there an official AICPA SOC 2 checklist? No. Linford and Co, a licensed CPA firm, says the AICPA has not issued a SOC 2 compliance checklist, and that all other checklists are just suggestions for meeting the SOC 2 criteria. The AICPA publishes the Trust Services Criteria, and the points of focus under them are guidance. - Which SOC 2 criteria are mandatory? Security, also called the common criteria. A-LIGN and Linford and Co both say it must be in scope for every SOC 2. Availability, Confidentiality, Processing Integrity and Privacy are added only when they fit the service and the customers. - How long is a SOC 2 observation window? A Type 2 window runs 3 to 12 months. Linford and Co suggests aiming for at least 6 months, and Scrut says 3 months is the practical floor because it captures one quarterly access review. A Type 1 report has no window and covers one date. - Does compliance software complete the SOC 2 checklist? It automates parts of it: evidence collection, policy templates, access reviews, vendor risk and trust centers. A licensed CPA firm still examines the controls and issues the report. Thoropass is the one scored platform that delivers the audit through its own CPA firm.