SOC 2 Readiness: Gap Assessment to Evidence Collection.
10 documents for SOC 2 Type II readiness. Trust Service Criteria gap assessment, control mapping matrix, evidence collection templates, and management assertion: everything needed to engage an auditor with confidence.
10 documents: ready to implement.
SOC 2 Readiness Gap Assessment
Trust Service Criteria gap assessment across CC, A, C, PI, and P criteria: current state vs required controls
Trust Service Criteria Control Mapping
Control inventory mapped to Common Criteria (CC1–CC9), Availability, Confidentiality, Processing Integrity, and Privacy
System Description Template
Management's description of the system: service scope, components, and principal service commitments
Risk Assessment and Control Design
SOC 2 risk assessment with control design evidence and operating effectiveness rationale
Evidence Collection Tracker
Structured evidence collection log with auditor evidence request mapping and status tracking
Access Control and Logical Security Policy
CC6: user access provisioning, deprovisioning, privileged access, and access review procedures
Change Management Policy and Log
CC8: software development lifecycle controls, change approval, and deployment evidence requirements
Vendor Management and Monitoring Procedure
CC9: third-party vendor assessment, monitoring, and SLA compliance tracking
Incident Response and Communication Plan
CC7: security incident detection, response, and customer communication procedures
SOC 2 Audit Preparation Checklist
Final pre-audit readiness checklist covering documentation completeness, evidence gaps, and auditor engagement
What makes this different.
All five Trust Service Criteria
Common Criteria (CC), Availability (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P): the readiness assessment covers all five criteria so you can select your scope.
System description template included
The management system description (Point of Focus: Management's Description) is the document auditors scrutinise most: AIR-SOC2-003 provides the complete required structure.
Evidence collection tracker
SOC 2 auditors submit evidence requests (PBCs: Prepared By Client). AIR-SOC2-005 maps your controls to typical PBC requests so you know exactly what to collect.
Works with Type I and Type II
The gap assessment and control mapping support Type I (point in time) readiness, while the evidence collection and monitoring documents support Type II (period of operation) preparation.
SaaS and technology companies responding to enterprise customer SOC 2 requirements. Startups preparing for their first SOC 2 Type II audit. Security and compliance teams managing the SOC 2 readiness programme.
FAQ
Ready to implement?
Download SOC 2 Readiness Pack today: $1,099 AUD, instant delivery.