SOC 2 Compliance Checklist

Programme Checklist

• ☐ Define system boundary and system description draft
• ☐ Confirm Security in scope; select optional TSC (Availability, Processing Integrity, Confidentiality, Privacy)
• ☐ Choose Type I (point in time) vs Type II (period) path
• ☐ Assign control owners and evidence locations
• ☐ Publish policy set auditors commonly expect (see policy templates)
• ☐ Implement access, change, and monitoring controls (CC6–CC8)
• ☐ Vendor risk process for CC9 / customer CUECs
• ☐ Run readiness / gap assessment and remediate
• ☐ Start observation period evidence (Type II) — typically 3–12 months in market practice
• ☐ Engage licensed CPA firm; schedule fieldwork
• ☐ Prepare bridge-letter plan if customers need coverage between reports

Need a structured worksheet version? Request via contact — we do not publish a fake public Excel download link.

How CyberSilo Helps

CSA tracks checklist items as live control status with linked artefacts for auditor packages.

Frequently Asked Questions

Is this checklist an official AICPA form?

No. It is an operational readiness outline aligned to common programme steps.

Do we need Type I before Type II?

Not always. Many teams start with Type I for speed; mature programmes sometimes go straight to Type II.

Where do policies fit?

Policies document expected behaviour; controls and evidence show design and operation. See the policy templates guide.

Related SOC 2 Resources

SOC 2 hub · Cost · Choose an auditor · CSA