What it is
A SOC 2 report is the product of an examination by an independent CPA, under AT-C 105 and AT-C 205, of a service organization’s controls against the AICPA trust services criteria. The categories are security, availability, processing integrity, confidentiality and privacy. Security is the common criteria set (CC1 to CC9) and is always in scope.
This checklist is a self-assessment for a service organization preparing for an examination. It covers scoping, the system description, each category, evidence and the relationship with the service auditor. It is not a readiness opinion and does not say that any entity meets the criteria.
When to use it
- A service organization planning its first SOC 2 examination.
- Mapping existing controls to the criteria before a gap assessment.
- CPA firms scoping a SOC 2 examination or a readiness engagement.
What’s inside
- Scope, categories and Type 1 versus Type 2 choice
- Security common criteria CC1 to CC9
- Availability, confidentiality, processing integrity and privacy criteria
- Control matrix and evidence expectations
- Management assertion and service auditor independence
Standard cited
This template follows AT-C 105 / AT-C 205 / AICPA TSC. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Do all five categories have to be in the report?
No. Security is required. The other four are added when customer commitments and system requirements call for them.
What is the difference between Type 1 and Type 2?
Type 1 reports on the description and the suitability of design of controls at a point in time. Type 2 adds the operating effectiveness of controls over a period. The period is agreed with the service auditor.
Can the examining firm help build the controls?
Only after evaluating independence. A firm that examines a service organization’s controls must be independent of it, helping to design controls is a nonattest service that has to be evaluated under the AICPA Code (ET 1.295), and performing management responsibilities, such as operating the controls, impairs independence.
Related templates
Last updated 11/05/2026. All free templates.