Security · 9 min read
SOC 2 readiness checklist for startups and small businesses
By the Cloudisoft team · Updated
Short answer
To get ready for SOC 2, define the scope, choose your Trust Services Criteria (Security is always required), put core controls in place — access control with MFA, onboarding and offboarding, logging and monitoring, change management, backups, incident response, vendor management and security training — write the matching policies, and collect evidence that the controls operate. An independent CPA firm then performs the audit.
SOC 2 in one paragraph
SOC 2 is an attestation report, defined by the AICPA, that shows customers how a service organisation protects their data. It is not a certificate you buy: an independent CPA firm tests your controls against the Trust Services Criteria and issues a report. Larger customers often ask for it before they sign.
Type I vs Type II
| Type I | Type II | |
|---|---|---|
| What it tests | Whether controls are designed properly at a point in time | Whether controls operated effectively over a period |
| Observation period | None — a single date | Typically several months to a year |
| Typical use | A first report to unblock deals quickly | The report most enterprise customers ask for |
Choose your Trust Services Criteria
- Security (common criteria) — required in every SOC 2.
- Availability — if customers rely on your uptime.
- Confidentiality — if you handle confidential business data.
- Processing integrity — if accuracy of processing is part of your promise.
- Privacy — if you handle personal information as a core part of the service.
Most first audits cover Security only, or Security plus Availability and Confidentiality.
The readiness checklist
- Scope — the systems, data, people and vendors in the audit.
- Risk assessment — documented risks and how each is handled.
- Policies — information security, access control, change management, incident response, vendor management, data retention, acceptable use.
- Identity and access — single sign-on where possible, MFA everywhere, least privilege, quarterly access reviews.
- Onboarding and offboarding — background checks where appropriate, policy acknowledgement, same-day access removal.
- Asset inventory — laptops, cloud accounts and SaaS tools, with disk encryption and endpoint protection.
- Change management — code review, approvals and separation between development and production.
- Logging and monitoring — centralised logs, alerts on suspicious activity, log retention.
- Backups and recovery — automated, encrypted backups and a tested restore.
- Incident response — a written plan, roles, and at least one tabletop exercise.
- Vendor management — a list of critical vendors and their security reports.
- Security awareness training — for everyone, at hiring and yearly.
- Encryption — data encrypted in transit and at rest.
Evidence auditors will ask for
- Screenshots or exports showing MFA enforcement and access reviews.
- Tickets showing onboarding, offboarding and approved changes.
- Backup logs and a record of a successful restore test.
- Signed policy acknowledgements and training completion records.
- Incident and alert records, and how they were resolved.
Cloudisoft prepares companies for SOC 2: we build the cloud controls, write the policies and set up evidence collection, then coordinate with your chosen audit firm. Cloud, security and compliance projects start from $1,500.