SOC 2 Compliance Checklist

Tone at the top, policies, oversight and how you communicate commitments.

• OC1The organization maintains an inventory of production information assets, including asset owner, data classification and location. Management reviews and updates the inventory as needed.
  What auditors ask for

  Asset inventory export with owner, classification and location columns, and the date of the last review.

  TSC CC6.1
• OC4The organization has defined a Code of Conduct and Ethics and reviews it annually.
  What auditors ask for

  Code of Conduct with version history showing the annual review and approval.

  TSC CC1.1
• OC5An employee handbook sets out the Code of Conduct, acceptable use and confidentiality commitments. Executive management reviews it annually. Every employee signs an acknowledgement at onboarding and again after any significant revision.
  What auditors ask for

  Current handbook, approval record, and signed acknowledgements for a sample of employees.

  TSC CC1.1, CC2.2
• OC6The executive team meets monthly to discuss operations, internal control issues and key performance metrics.
  What auditors ask for

  Meeting calendar and minutes or agendas for the audit period.

  TSC CC1.2, CC2.2
• OC7Formal agreements with customers set out the organization's security, confidentiality and privacy commitments.
  What auditors ask for

  Master services agreement or terms of service, plus a sample of signed customer contracts.

  TSC CC2.3
• OC8The organization documents its internal controls and monitors their effectiveness. Management assesses the controls, processes and policies at least annually and remediates deficiencies in a timely manner.
  What auditors ask for

  Control matrix, annual control assessment or internal audit report, and remediation tickets for findings.

  TSC CC4.1, CC4.2
• OC9Employees can report fraud, harassment and other ethics or integrity concerns through a secure and anonymous channel.
  What auditors ask for

  Whistleblower policy and a screenshot or link to the anonymous reporting channel.

  TSC CC1.1, CC2.2
• OC10Management reviews new customer contracts, changes to existing contracts, and end user licence agreements annually to confirm that security and confidentiality commitments are met.
  What auditors ask for

  Contract review log or sign-off records for the audit period.

  TSC CC2.3
• OC11Security, confidentiality and availability policies and procedures are kept in a central platform and made available to employees. Management reviews and approves them annually or after significant changes.
  What auditors ask for

  Policy library with owner, version and approval date for each policy.

  TSC CC5.3, CC2.2
• OC12Employees complete information security and awareness training annually.
  What auditors ask for

  Training completion report for all employees in the audit period.

  TSC CC1.4, CC2.2
• OC13Designated customer administrators and relevant employees are trained on the functional use of the application during onboarding, so they understand their roles and responsibilities.
  What auditors ask for

  Onboarding training materials and completion records for customers and employees.

  TSC CC2.2, CC2.3
• OC14Documentation and user guides describe the system components and the purpose and design of the system. They are available to internal and external users and updated as needed.
  What auditors ask for

  System description, user guides or help centre, and their last update dates.

  TSC CC2.2, CC2.3

Roles, hiring, competence and training.

• HR1Contracts with employees and contractors state their information security roles and responsibilities.
  What auditors ask for

  Employment and contractor agreement templates with the security and confidentiality clauses.

  TSC CC1.3, CC2.2
• HR2Job descriptions set out each role's objectives, responsibilities, reporting lines and required qualifications. They are available to employees and reviewed annually or after significant changes.
  What auditors ask for

  Job descriptions for in-scope roles with review dates.

  TSC CC1.3
• HR3An organization chart defines roles, reporting lines and authority for development, quality assurance and security operations. It is updated after significant changes.
  What auditors ask for

  Current organization chart and its revision history.

  TSC CC1.3
• HR4The organization evaluates employee competence and identifies development needs annually.
  What auditors ask for

  Performance review records for a sample of employees.

  TSC CC1.4
• HR5A formal training plan exists, and management meets annually to identify training needs that support the in-scope systems.
  What auditors ask for

  Annual training plan and the minutes of the planning meeting.

  TSC CC1.4
• HR6New employees and contractors pass background and reference checks before they join.
  What auditors ask for

  Background check confirmations for a sample of new hires in the audit period.

  TSC CC1.4

How you identify, rate and treat business and security risk.

• RA1Management maintains insurance coverage against major financial risks to the business.
  What auditors ask for

  Certificate of insurance, including cyber coverage where held.

  TSC CC9.1
• RA2Management performs a formal risk assessment annually or after significant changes, covering security, fraud, regulatory and technology risks. Identified risks and their mitigation are documented and acted on by executive management.
  What auditors ask for

  Risk assessment report and risk register with owners, ratings and treatment plans.

  TSC CC3.1, CC3.2, CC3.3, CC3.4

How you choose, contract with and monitor suppliers.

• VM1Contractors and vendors working on the organization's behalf sign an agreement covering code of conduct, security and confidentiality requirements.
  What auditors ask for

  Signed vendor agreements or NDAs for a sample of vendors.

  TSC CC9.2
• VM2Management reviews the SOC reports of key service providers annually, checking scope, the impact of exceptions, and the complementary user entity controls that apply.
  What auditors ask for

  Vendor SOC report review memos, with the CUEC mapping for each key vendor.

  TSC CC9.2
• VM3Management risk-assesses new vendors before onboarding and evaluates existing vendors annually. Corrective action is taken where needed.
  What auditors ask for

  Vendor inventory with risk ratings, plus completed vendor assessments.

  TSC CC9.2
• VM4The vendor management process includes security steps to follow when a vendor relationship ends.
  What auditors ask for

  Vendor offboarding procedure and a completed offboarding record, if one occurred.

  TSC CC9.2

How users prove who they are.

• AA1Unique user IDs and strong passwords are required to access the infrastructure that supports the application, such as directory services, servers and databases.
  What auditors ask for

  Password policy settings from the identity provider, cloud console and databases.

  TSC CC6.1
• AA2Unique user IDs and strong passwords are required to access the application production environment.
  What auditors ask for

  Password configuration for the production application and its admin console.

  TSC CC6.1
• AA3Multi-factor authentication (MFA) is enforced for every account with administrative access to the production platform.
  What auditors ask for

  MFA enforcement settings and a user list showing MFA status for admin accounts.

  TSC CC6.1

Who gets access, how it is approved, and how it is taken away.

• AC1Access to in-scope systems requires a documented request and management approval before it is provisioned.
  What auditors ask for

  Access request tickets with approvals for a sample of new users.

  TSC CC6.2, CC6.3
• AC2An employee termination checklist ensures access is revoked for departing employees in a timely manner.
  What auditors ask for

  Termination checklists and access removal timestamps for a sample of leavers.

  TSC CC6.2, CC6.3
• AC3Access to generic administrator and privileged accounts on databases and servers is limited to authorized personnel through role-based access.
  What auditors ask for

  List of privileged accounts with owners and roles, and the role definitions.

  TSC CC6.1, CC6.3
• AC4Management reviews user access to in-scope systems quarterly. Access is changed or removed promptly based on the review.
  What auditors ask for

  Quarterly access review records with sign-off and the resulting change tickets.

  TSC CC6.2, CC6.3
• AC5Systems are configured so that each customer's access and data are segregated from other tenants.
  What auditors ask for

  Architecture notes on tenant isolation and test results that show segregation.

  TSC CC6.1
• AC6Only authorized personnel can promote changes to production, based on their job responsibilities.
  What auditors ask for

  Deployment permission settings in the CI/CD pipeline and repository branch protection rules.

  TSC CC6.1, CC8.1

How changes are planned, tested, approved and released.

• CM1A formal change management process governs changes to applications and supporting infrastructure. IT management reviews it annually and updates it as needed.
  What auditors ask for

  Change management policy with annual review evidence.

  TSC CC8.1
• CM2Emergency changes are documented and follow the standard process on an accelerated timeline. Approval is obtained and recorded before the change starts.
  What auditors ask for

  Emergency change tickets with approvals for the audit period.

  TSC CC8.1
• CM3A formal system development life cycle (SDLC) governs the development, acquisition, implementation and maintenance of applications.
  What auditors ask for

  SDLC policy or secure development procedure.

  TSC CC8.1
• CM4Changes that affect system functionality or security are communicated to internal and external users.
  What auditors ask for

  Release notes, changelog or customer notifications for significant changes.

  TSC CC2.2, CC2.3
• CM5Changes are documented, tested and approved by authorized personnel before they reach production.
  What auditors ask for

  A sample of pull requests or change tickets showing tests and approvals before deployment.

  TSC CC8.1
• CM6Changes are developed and tested in a development or test environment that is separate from production.
  What auditors ask for

  Environment diagram or account structure showing separate development, test and production.

  TSC CC8.1

Hardening, monitoring, encryption and capacity of the production platform.

• SO1Antivirus or anti-malware software prevents or detects malicious software and acts on it.
  What auditors ask for

  Endpoint or server protection console showing coverage and current definitions.

  TSC CC6.8
• SO2Infrastructure scales automatically to meet capacity and performance needs.
  What auditors ask for

  Auto-scaling configuration from the cloud provider.

  TSC A1.1
• SO3Baseline configurations are kept in a configuration management tool, so any approved change can be rolled back.
  What auditors ask for

  Infrastructure-as-code repository or configuration baselines with version history.

  TSC CC7.1, CC8.1
• SO4The cloud provider's key management service encrypts data at rest and stores and manages the keys. Access to production keys is limited to authorized individuals.
  What auditors ask for

  Key management configuration and the access policy for production keys.

  TSC CC6.1
• SO5Customer data is encrypted at rest, in storage and in backups, using strong encryption.
  What auditors ask for

  Encryption settings for databases, storage and backups.

  TSC CC6.1
• SO6Encryption protects data sent over public networks and between systems.
  What auditors ask for

  TLS configuration, certificate details and a scan showing strong protocols only.

  TSC CC6.7
• SO7Future processing demand is forecast and compared with planned capacity on an ongoing basis. IT management reviews and approves forecasts, and raises change requests as needed.
  What auditors ask for

  Capacity forecasts with IT management approval.

  TSC A1.1
• SO8Intrusion detection or prevention systems monitor the network continuously to detect and stop potential breaches.
  What auditors ask for

  IDS or IPS configuration and a sample of alerts with follow-up.

  TSC CC6.6, CC7.2
• SO9A formal log management process restricts who can change log configuration or modify logs.
  What auditors ask for

  Log retention settings and the access policy for log storage.

  TSC CC7.2
• SO10A central mobile device management (MDM) solution enforces security controls on all mobile devices.
  What auditors ask for

  MDM console showing enrolled devices and the enforced policies.

  TSC CC6.8
• SO11A network diagram shows boundary protection, such as firewalls and IDS, for all network connections. IT management reviews it annually.
  What auditors ask for

  Current network diagram with its review date.

  TSC CC6.6
• SO12A patch management process remediates operating system vulnerabilities in a timely manner. Production servers are scanned quarterly for patch compliance.
  What auditors ask for

  Patch policy, quarterly patch compliance scans and remediation records.

  TSC CC7.1
• SO13An annual penetration test identifies security weaknesses. Findings are rated by risk, analyzed and remediated in a timely manner.
  What auditors ask for

  Penetration test report and remediation evidence for each finding.

  TSC CC4.1, CC7.1
• SO14Logging captures administrative activity, logon attempts and changes to functions, security settings, permissions and roles. Automated alerts notify IT management, and issues are resolved through incident management.
  What auditors ask for

  Logging configuration, alert rules and a sample of alerts with their tickets.

  TSC CC7.2
• SO15Firewalls on the application gateway and production network block unnecessary ports, protocols and services. IT management reviews the rules annually.
  What auditors ask for

  Firewall or security group rules and the annual review record.

  TSC CC6.6
• SO16Monitoring tools track system capacity and performance to detect anomalies that could affect availability. Confirmed events go through incident management.
  What auditors ask for

  Monitoring dashboards, alert thresholds and a sample of related incidents.

  TSC A1.1, CC7.2
• SO17Quarterly vulnerability scans identify threats and weaknesses in production. Findings are analyzed and remediated in a timely manner.
  What auditors ask for

  Four quarterly scan reports and remediation tickets.

  TSC CC7.1
• SO18Code review addresses security and quality issues during development.
  What auditors ask for

  A sample of merged pull requests with reviewer approval.

  TSC CC8.1
• SO19Designated personnel review open source libraries for security and licensing issues before use.
  What auditors ask for

  Dependency or software composition scanning results and the approval process.

  TSC CC8.1
• SS7Management reviews serverless functions and their permissions quarterly to confirm they are needed and configured correctly.
  What auditors ask for

  Quarterly review records listing functions, roles and permissions.

  TSC CC6.3

How production data is protected, retained and disposed of.

• DS2Production data is masked or anonymized whenever it is used outside production.
  What auditors ask for

  Data masking procedure and an example of masked data.

  TSC C1.1, CC6.1
• DS3Production data is not used in testing or development environments.
  What auditors ask for

  Policy statement and a review of test data sources.

  TSC C1.1, CC8.1
• DS4Formal procedures govern the secure retention and disposal of information.
  What auditors ask for

  Data retention and disposal policy with the retention schedule.

  TSC C1.1, C1.2
• DS5Equipment that stores data is disposed of or recycled through a certified disposal vendor.
  What auditors ask for

  Certificates of destruction from the disposal vendor.

  TSC CC6.5
• DS6Access to production data used outside production is limited by job need and needs the same authorization as in production.
  What auditors ask for

  Access lists and approvals for any non-production copies of production data.

  TSC CC6.1

Laptops and desktops that staff use.

• WS1Firewall, antivirus and anti-spam software is installed and enabled on all workstations.
  What auditors ask for

  Endpoint management report showing security software on every workstation.

  TSC CC6.8
• WS2Disk encryption and system passwords are enabled on all workstations.
  What auditors ask for

  Device management report showing disk encryption and screen lock status.

  TSC CC6.1, CC6.7
• WS3A patch management process remediates workstation operating system vulnerabilities in a timely manner. Workstations are scanned quarterly for patch compliance.
  What auditors ask for

  Quarterly workstation patch compliance reports.

  TSC CC7.1

Offices and data centres. For a cloud-only company, the data centre controls usually come from your cloud provider's SOC 2 report.

• PE1Environmental protections are installed and maintained at least annually, including cooling, UPS, redundant communication lines, smoke detectors and sprinklers.
  What auditors ask for

  Cloud provider SOC report, or maintenance records if you run your own facility.

  TSC A1.2Often inherited from your cloud provider
• PE2Operations staff monitor environmental protections each shift. Alerts flag any reading outside its threshold.
  What auditors ask for

  Cloud provider SOC report, or monitoring logs for your own facility.

  TSC A1.2Often inherited from your cloud provider
• PE3Access to data centres and other secure areas requires formal authorization from IT management before it is provisioned.
  What auditors ask for

  Cloud provider SOC report, or access approvals for your own secure areas.

  TSC CC6.4Often inherited from your cloud provider
• PE4Physical access to the office requires formal authorization from IT management before it is provisioned.
  What auditors ask for

  Badge or key request approvals for a sample of employees.

  TSC CC6.4
• PE5The employee termination checklist ensures physical access is revoked promptly for departing employees.
  What auditors ask for

  Termination checklists showing badge or key return for a sample of leavers.

  TSC CC6.4
• PE6Physical security controls protect offices, rooms and facilities from unauthorized access.
  What auditors ask for

  Office security description, such as badge readers, locks and visitor logs.

  TSC CC6.4
• PE7Management reviews physical access to data centres and other secure areas quarterly.
  What auditors ask for

  Cloud provider SOC report, or quarterly access reviews for your own secure areas.

  TSC CC6.4Often inherited from your cloud provider
• PE8Management reviews physical access to the office quarterly.
  What auditors ask for

  Quarterly badge access reviews with sign-off.

  TSC CC6.4

How you detect, handle, communicate and learn from incidents.

• IR1An external support channel lets users report incidents, complaints and other issues. Support staff address reported incidents in a timely manner.
  What auditors ask for

  Support portal or contact page, and a sample of tickets with response times.

  TSC CC2.3, CC7.3
• IR2Confirmed data breaches are notified to affected individuals, regulators and other parties, as applicable, within a timeframe that meets the organization's privacy and confidentiality commitments.
  What auditors ask for

  Breach notification procedure, with timelines that reflect the laws and contracts that apply.

  TSC CC7.4
• IR3A formal incident management process requires incidents to be tracked, documented and resolved completely, accurately and on time. Management reviews the process annually.
  What auditors ask for

  Incident response plan with annual review evidence.

  TSC CC7.3, CC7.4
• IR4All security incidents are logged, tracked, communicated to affected parties and resolved on time under the incident management process.
  What auditors ask for

  Incident log and a sample of incident tickets from the audit period.

  TSC CC7.3, CC7.4
• IR5Management has defined roles and responsibilities for overseeing security policies, including incident response.
  What auditors ask for

  Incident response roles in the plan, or a RACI chart.

  TSC CC1.3, CC7.4
• IR6Lessons learned from incidents are built into the incident response procedures on an ongoing basis.
  What auditors ask for

  Post-incident reviews and the resulting procedure updates. A tabletop exercise works if there were no incidents.

  TSC CC7.5

Getting your data and service back after a failure.

• CR2Automated weekly full and daily incremental backups are replicated offsite. An automated system monitors backups for failure.
  What auditors ask for

  Backup configuration, replication settings and backup failure alerts.

  TSC A1.2
• CR6Disaster recovery plans, including backup restoration, are tested annually. Results are reviewed and the plans updated.
  What auditors ask for

  Disaster recovery plan, the annual test report and resulting plan updates.

  TSC A1.3