What it is
A SOC 2 examination is performed by an independent service auditor on management’s description of a system and the suitability of design, and for a Type 2 report the operating effectiveness of controls, against the AICPA Trust Services Criteria. This checklist organizes the readiness work: scope, the security (common) criteria, additional categories and the description and evidence.
It is a planning tool. Completing it does not mean an organization will receive a SOC 2 report, and a SOC 2 report is an attestation, not a certification. For the exact requirements, use the AICPA Trust Services Criteria (2017, with revised points of focus, 2022) and the AICPA description criteria for a SOC 2 report.
When to use it
- Deciding whether a service organization is ready for a SOC 2 examination.
- Planning scope, categories and the examination period with management.
- Tracking control gaps and remediation before the service auditor starts.
What’s inside
- Scope and engagement design: system, categories, report type, period and subservice organizations
- Control environment, risk assessment and monitoring
- Access, system operations, change management and vendor risk
- Availability, processing integrity, confidentiality and privacy
- System description, evidence and readiness conclusion
Standard cited
This template follows AT-C 105 / AT-C 205 / TSC. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Which categories are required?
Security, which is the common criteria, is always in scope. Availability, processing integrity, confidentiality and privacy are included when relevant to the service organization’s commitments and system requirements.
What is the difference between Type 1 and Type 2?
A Type 1 report covers the description and the suitability of design at a point in time. A Type 2 report also covers operating effectiveness over a period, which is why controls must have been operating and generating evidence before it starts.
Is SOC 2 a certification?
No. It is an examination report from an independent service auditor under AT-C 105 and AT-C 205. Organizations should describe it as a SOC 2 report, not a certification.
Related templates
- SOC 2 Control Matrix (Trust Services Criteria)
- SOC 1 Readiness Checklist (SSAE 18, AT-C 320)
- ITGC Testing Matrix: Access, Change and Operations
Last updated 11/05/2026. All free templates.