SOC 2 Readiness Checker
Run a free readiness assessment against the AICPA Trust Services Criteria. Get an instant readiness score, a prioritized gap list with remediation advice, and a downloadable PDF report. No signup.
What Is SOC 2?
SOC 2 is an independent audit report from the AICPA that attests how a service organization protects customer data. Unlike a certification, it is an auditor's opinion on whether your controls are designed (Type I) and operating effectively over time (Type II) against the Trust Services Criteria.
Enterprise buyers increasingly require a SOC 2 report before signing. This tool measures how far your current controls are from audit-ready.
What This Tool Covers
- •Security (Common Criteria): the CC1–CC9 series — always in scope for every SOC 2 report
- •Availability: capacity, redundancy, recovery testing (A1 series)
- •Processing Integrity: input validation and output accuracy (PI1 series)
- •Confidentiality: classification, retention, secure disposal (C1 series)
- •Privacy: notice, consent, data subject rights, PII disposal (P series)
Only Security is mandatory — mark questions N/A for categories outside your scope and they won't count against your score.
How It Works
- 1.Answer ~30 questions about your current controls and practices
- 2.Get an instant readiness score with a letter grade (A–E)
- 3.Review your prioritized gap list with remediation recommendations
- 4.Download a professional PDF report for your management team
SOC 2 Readiness Assessment
Assess your organization against the AICPA Trust Services Criteria. The Common Criteria (Security) section is required in every SOC 2 report; mark Availability, Processing Integrity, Confidentiality, or Privacy questions N/A if those categories aren't in your scope. Your answers stay in your browser.
Frequently Asked Questions
What is a SOC 2 readiness assessment?
A readiness assessment (also called a gap assessment) compares your current controls against the Trust Services Criteria before you hire an auditor. It surfaces the gaps that would cause exceptions in a real examination, so you can fix them first — auditors charge by scope and a failed Type II means restarting the observation period.
What is the difference between SOC 2 Type I and Type II?
Type I audits whether your controls are suitably designed at a point in time. Type II verifies they operated effectively over an observation period, typically 3–12 months. Most buyers ask for Type II; Type I is the usual first step to prove design before the clock starts.
Which Trust Services Categories do I need?
Security (the Common Criteria) is always required. Add Availability if you make uptime commitments, Processing Integrity if you process transactions, Confidentiality if you handle sensitive business data, and Privacy if you handle personal information. Mark out-of-scope questions N/A — they are excluded from your score.
How long does SOC 2 take?
Readiness work typically takes 2–6 months depending on your starting point. After that, a Type I audit takes a few weeks, while Type II requires a 3–12 month observation period. Companies with strong existing controls (e.g., ISO 27001 certified) often move much faster.
Is this a substitute for a SOC 2 audit?
No. This is a self-assessment that gives you a baseline and a remediation roadmap. A SOC 2 report can only be issued by a licensed CPA firm after a formal examination — but arriving with a completed readiness assessment significantly reduces audit findings.
Is my assessment data uploaded or stored?
No — the scoring and PDF generation run entirely in your browser. Your answers are never sent to our servers. Only your contact details are submitted, to send you a copy of the report.