Is this SOC 2 checklist free?

Yes. Build it, download it as Excel or PDF, and edit it however you like. There is no signup and no email gate.

Which Trust Services Criteria should my first SOC 2 cover?

Security alone, for most small teams. Every SOC 2 report includes it. Add Availability, Confidentiality, Processing Integrity or Privacy only when a customer or a contract you signed asks for it, and you can add one at renewal.

Should I build the checklist for a Type 1 or a Type 2?

Type 2, in most cases. It is the report most buyers ask for, and a 3-month observation window gets you there fastest. A Type 1 is the option when a prospect needs a report in under about 3 months. The checklist changes what the auditor checks for each item depending on which you pick.

What is in the spreadsheet?

One row per control, with the criteria code, what to do, the evidence the auditor asks for, when the auditor checks it, a suggested owner, a status dropdown and a notes column. A second sheet records the choices you made.

Does finishing the checklist mean I pass SOC 2?

No checklist can promise a clean report; the auditor decides. Use it to make sure each control is in place and its evidence is filed before your observation window or fieldwork starts.

SOC 2 Checklist Template

Pick your scope, report type and team size, then download a tailored checklist as Excel or PDF. No signup, no email.

30 items

SOC 2 checklist: 30 items for your scope
Item	Criteria	Evidence the auditor asks for	When the auditor checks	Suggested owner
Access Control (CC6): Where Most Audits Fail
MFA everywhere	CC6.1	Screenshots or exports of the enforcement setting in each system.	On for the whole observation window	CTO or lead engineer
SSO and role-based access	CC6.1	Your role list and an export of current users with their roles.	On for the whole observation window	CTO or lead engineer
Provisioning	CC6.2	Access request tickets showing who asked, who approved, and when access was granted.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Offboarding	CC6.2	An offboarding ticket showing each account disabled and the date.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Quarterly access review	CC6.2	The signed-off review listing the accounts checked, who checked them, what was removed, and the date.	Every quarter of the window	CTO or lead engineer
Service accounts	CC6.1	A list of service accounts with owners and the last rotation date for each key.	On your written schedule through the window	CTO or lead engineer
Change Management (CC8)
Required code review	CC8.1	A few merged pull requests, each showing a reviewer approved it before the merge.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Branch protection	CC8.1	A screenshot or export of the branch protection settings.	On for the whole observation window	CTO or lead engineer
Emergency changes	CC8.1	The emergency change record with its after-the-fact review.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Separate writing from deploying	CC8.1	Your deploy permissions, or the log of those after-the-fact reviews.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Risk Assessment and Governance (CC3, CC1)
Information security policy	CC1.1	The approved policy with its approval date and the employee acknowledgment records.	Done within the last 12 months, dated	Founder
Risk assessment	CC3.1, CC3.2	The dated risk assessment document.	Done within the last 12 months, dated	Founder
Risk register	CC3.2	The register itself, with an owner and a review date on every risk.	Done within the last 12 months, dated	Founder
Management oversight	CC1.2	The notes from your most recent review.	Every quarter of the window	Founder
Code of conduct	CC1.1	The code of conduct and the signed acknowledgments.	Every time it happens in the window; the auditor tests samples	Founder
Monitoring, Incidents, and Backups (CC7)
Logging and alerting	CC7.2	Your logging and alerting settings, including how long logs are kept.	On for the whole observation window	CTO or lead engineer
Incident response plan and incident log	CC7.3, CC7.4	The approved plan with its date, and the incident log even if it is empty.	Every time it happens in the window; the auditor tests samples	CTO or lead engineer
Vulnerability scanning with patch deadlines	CC7.1	Recent scan reports and tickets showing critical findings fixed within your deadline.	On your written schedule through the window	CTO or lead engineer
Backups with a restore test	CC7.5	Your backup settings and a dated record of your last restore test.	On your written schedule through the window	CTO or lead engineer
Vendor Management (CC9.2)
Vendor list with risk tiers	CC9.2	The vendor list with a tier for each vendor.	On for the whole observation window	Founder
Reports for high-risk vendors	CC9.2	The reports you collected, filed against each high-risk vendor.	Done within the last 12 months, dated	Founder
Contract terms	CC9.2	The signed contract clauses or data processing agreement for each high-risk vendor.	Every time it happens in the window; the auditor tests samples	Founder
Annual re-review	CC9.2	The dated review notes and the current report for each high-risk vendor.	Done within the last 12 months, dated	Founder
Data Protection
Encryption at rest	CC6.1	Screenshots of the encryption setting on each data store.	On for the whole observation window	CTO or lead engineer
Encryption in transit	CC6.1	A TLS scan of your public endpoints and the renewal settings for each TLS/SSL certificate.	On for the whole observation window	CTO or lead engineer
Data classification	CC6.5	Your data classification policy.	On for the whole observation window	Founder
Data retention and disposal	CC6.5	Your retention schedule and a record of a recent deletion.	On your written schedule through the window	CTO or lead engineer
People Security
Background checks	CC1.4	A record that each check was completed before access was granted.	Every time it happens in the window; the auditor tests samples	Founder
Security awareness training	CC1.4	Training completion records for every current employee.	Done within the last 12 months, dated	Founder
Confidentiality agreements	CC1.4	Signed agreements dated before each person's first access.	Every time it happens in the window; the auditor tests samples	Founder

The downloads add a plain-language step for every item, a status column and, in the PDF, a tick box.

Next: Questionnaire coverage

Track every item in SimpleAudit

SimpleAudit would track all 30 of these items for you and file the proof against each one.

Essentials tracks every item and files its proof for $199/mo billed annually, 7-day free trial.

Start free trial

What a SOC 2 checklist is

A SOC 2 checklist lists the controls an auditor will test and the evidence they will ask to see for each one. For a first audit, most small teams should cover Security only and go straight to a Type 2 with a 3-month observation window. This tool builds that list for your scope and team size, with a suggested owner for each item. Get the controls an auditor will test and the proof for each, as an Excel or PDF file you can edit.

How to use it

Start with the defaults, which are the recommended path for a first report, then change only what is true for your company. The list updates as you go.

Scope. Security is always included. Tick another criterion only when a customer or a contract asks for it.
Report type. A Type 2 means the auditor tests that each control kept working through your observation window. A Type 1 checks that the controls are in place on one day. Not sure which you need? The Type 1 or Type 2 quiz compares both paths.
Team size. It only changes the suggested owner. A founder-led team gives most items to the founder or the lead engineer, and a larger team gives them to a function.

What is in each row

Each row names the control, its criteria code, the evidence to collect, when the auditor checks it and who should own it. The downloads add a plain-language step for each item, a status column to track progress and a notes column. For the reasoning behind each control, read the full SOC 2 checklist guide.

Questions about the SOC 2 checklist

Is this SOC 2 checklist free?: Yes. Build it, download it as Excel or PDF, and edit it however you like. There is no signup and no email gate.
Which Trust Services Criteria should my first SOC 2 cover?: Security alone, for most small teams. Every SOC 2 report includes it. Add Availability, Confidentiality, Processing Integrity or Privacy only when a customer or a contract you signed asks for it, and you can add one at renewal.
Should I build the checklist for a Type 1 or a Type 2?: Type 2, in most cases. It is the report most buyers ask for, and a 3-month observation window gets you there fastest. A Type 1 is the option when a prospect needs a report in under about 3 months. The checklist changes what the auditor checks for each item depending on which you pick.
What is in the spreadsheet?: One row per control, with the criteria code, what to do, the evidence the auditor asks for, when the auditor checks it, a suggested owner, a status dropdown and a notes column. A second sheet records the choices you made.
Does finishing the checklist mean I pass SOC 2?: No checklist can promise a clean report; the auditor decides. Use it to make sure each control is in place and its evidence is filed before your observation window or fieldwork starts.

Build your checklist