The Complete SOC 2 Type 2
Preparation Checklist for 2026

A SOC 2 Type 2 audit is the most thorough security attestation process your organization will undergo. Preparation is the difference between a clean opinion and a report full of exceptions. This checklist — compiled from our AICPA-certified auditors' experience across 500+ SOC 2 engagements — covers everything you need to be audit-ready across all five Trust Services Criteria.

Security (Common Criteria) — CC1 through CC9

Security is mandatory in all SOC 2 reports and covers 9 Common Criteria categories. Here's the preparation checklist for each:

CC1 — Control Environment

• ☐ Organizational chart with security responsibilities documented
• ☐ Security policies signed and distributed to all staff
• ☐ Security awareness training records (completion evidence)
• ☐ Management review meeting minutes referencing security
• ☐ Board/executive oversight documentation of security program

CC2 — Communication & Information

• ☐ Acceptable use policy distributed and acknowledged
• ☐ Security communication records (newsletters, alerts, updates)
• ☐ Incident communication logs to affected parties

CC3 — Risk Assessment

• ☐ Annual risk assessment completed and documented
• ☐ Risk register with likelihood/impact ratings
• ☐ Risk treatment decisions documented with owners
• ☐ Vendor risk assessment procedures and records

CC6 — Logical & Physical Access (Most Scrutinized)

• ☐ User access provisioning/deprovisioning records throughout audit period
• ☐ Quarterly (or more frequent) user access reviews — all systems
• ☐ MFA enforcement evidence for all remote access and privileged accounts
• ☐ Privileged access management (PAM) records
• ☐ Terminated employee access revocation within 24–48 hours (sampling evidence)
• ☐ Physical access logs for data center facilities

CC7 — System Operations

• ☐ Security monitoring / SIEM alert logs throughout audit period
• ☐ Vulnerability scanning results (minimum quarterly)
• ☐ Patch management records — critical patches applied within policy SLA
• ☐ Incident and problem management log — all security events documented
• ☐ Penetration testing report (annual minimum)

CC8 — Change Management

• ☐ Change management log for all system changes throughout audit period
• ☐ Change authorization records (approval before deployment)
• ☐ Testing documentation for significant changes
• ☐ Emergency change procedures and records
• ☐ Separation of duties — development vs. production access

Availability Criteria (A1)

• ☐ Uptime monitoring reports throughout audit period (target vs. actual SLA)
• ☐ Disaster recovery plan (DRP) documented and tested
• ☐ Business continuity plan (BCP) documented
• ☐ DR/BCP test results from the audit period
• ☐ Performance monitoring records
• ☐ Capacity planning documentation

Confidentiality Criteria (C1)

• ☐ Data classification policy and classification records
• ☐ Encryption-at-rest configuration evidence for confidential data
• ☐ Encryption-in-transit (TLS) configuration evidence
• ☐ Data retention and disposal procedures with records
• ☐ NDA/confidentiality agreement records with employees and vendors

Processing Integrity (PI1)

• ☐ Data validation controls documentation and testing records
• ☐ Error detection and correction procedures
• ☐ Transaction processing accuracy testing
• ☐ Reconciliation procedures and records

Privacy Criteria (P1–P8)

• ☐ Privacy policy (public-facing, current)
• ☐ Personal data inventory / data map
• ☐ Consent management procedures
• ☐ Individual rights request log and response records
• ☐ Data subject access request (DSAR) procedures
• ☐ Third-party data sharing agreements

Top 5 Most Common SOC 2 Type 2 Exceptions

Based on our audit experience, these are the most frequently cited control deficiencies:

1. Incomplete user access reviews: Reviews not performed on schedule or missing documentation of review completion
2. Delayed terminated employee access revocation: Access not removed within policy-required timeframe
3. Missing patch management evidence: Patches applied without documented timelines or critical patches delayed beyond SLA
4. Incomplete change management records: Changes deployed without documented authorization or testing evidence
5. Gaps in security monitoring: SIEM alerts not reviewed or reviewed without documented action