Free SOC 2 readiness assessment

Do you have a written information security policy approved by leadership?

A policy that says how you protect information, approved by a director and reviewed at least once a year.

Is one person clearly responsible for security?

A named owner (for example a CTO or security lead) with time and authority to run the programme.

Have you assessed your security risks in the last 12 months?

A risk register listing threats to your systems and data, how likely and how harmful each is, and what you do about it.

Do all staff complete security awareness training at least once a year?

Training on phishing, passwords, data handling and reporting incidents, with completion records.

Is multi-factor authentication (MFA) required for email, cloud services and admin accounts?

Every account on email, your cloud provider, code repositories and admin consoles needs a second factor.

Is access removed within one business day when someone leaves?

A leaver checklist that disables accounts, recovers devices and rotates shared secrets.

Do you review who has access to important systems at least every quarter?

A manager confirms that each person still needs their access, and removals are recorded.

Do people get only the access they need for their role?

Admin rights are limited to a few people; production and customer data access is restricted and approved.

Do you keep an up-to-date list of your devices, systems and cloud services?

An inventory with an owner for each laptop, server, cloud account and important SaaS tool.

Are all laptops encrypted and centrally managed?

Full-disk encryption, screen lock and the ability to wipe a lost device remotely.

Are security updates applied within a defined time?

For example critical patches within 14 days for laptops, servers and software you run.

Do devices run anti-malware or endpoint protection?

Endpoint protection that is active, updated and reports to someone who looks at alerts.

Is data encrypted in transit and at rest?

HTTPS/TLS for all traffic, encrypted databases, storage and backups.

Do you have rules for how long data is kept and how it is deleted?

Retention periods per data type and a way to delete or anonymise data when they expire.

Are security logs collected centrally and alerts reviewed?

Logs from identity, cloud and key applications kept in one place, with alerts someone actually reviews.

Are backups taken automatically and restores tested?

Automatic backups of critical data, stored separately, with at least one documented restore test a year.

Do you scan for vulnerabilities and have a penetration test at least yearly?

Regular automated scans of systems and code dependencies, plus an independent penetration test.

Are changes to production reviewed and approved before release?

Code review or change approval for every production change, with a record of who approved it.

Do you have an incident response plan that has been tested?

Who does what when something goes wrong, how incidents are logged, and a practice run in the last year.

Do you have a plan to keep critical services running during a major outage?

A business continuity and disaster recovery plan with recovery targets for your key systems.

Do you check the security of important vendors before you use them?

A review of a vendor's security evidence (SOC 2 report, ISO certificate or questionnaire) before onboarding.

Do you run background checks on new hires where the law allows?

Proportionate screening (identity, references, criminal record where lawful) before access is granted.

Do employees and contractors sign confidentiality terms?

Confidentiality clauses in employment contracts and NDAs for contractors.

Can you show evidence that these controls actually run?

Auditors and customers want proof over time: tickets, logs, review records, screenshots, training records.