SOC 2 compliance checklist

Forty-nine items in the order they have to happen, with the four that gate everything else named in the first paragraph. Your progress is saved in this browser, so you can work through it over weeks rather than in one sitting.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Four things gate everything else, and if you do only four things this quarter, do these: get the report type confirmed in writing, turn on multi-factor authentication everywhere including your cloud root accounts, start keeping evidence with dates on it, and pick your observation window start date. Everything else on this page can be done in parallel. Those four cannot be compressed later.

The list below is ordered the way the work actually happens rather than the way the criteria are numbered. Progress is stored in your own browser and nowhere else, so you can close the tab and come back.

Phase one: settle the scope

Two weeks, mostly waiting on other people. Doing this badly is the most expensive mistake available, because every later decision inherits it.

0 of 0 done · Reset

• Identify who asked for the report and get their exact wording in writing
• Confirm Type 1 or Type 2. If nobody said, ask, because it changes the budget by tens of thousands of Canadian dollars
• Confirm which Trust Services categories. Security only unless a customer named another one
• Get the date they need it by, and who set that date
• Write the system boundary: which products, which cloud accounts, which environments
• List your subservice organisations and decide carve-out or inclusive with your auditor
• Build a four-line budget: examination, readiness, platform, penetration test
• Name one internal owner with authority to make decisions, not a committee

Use the deadline calculator once you have the date. It tells you whether a Type 2 can exist by then. What drives a quote covers how the scope decisions above turn into a fee.

Phase two: the control set

Two to five months, and this is where all the real work is. An auditor tests whether these operated, not whether you wrote them down, so a policy signed yesterday describing a process nobody follows is worse than no policy.

0 of 0 done · Reset

• Multi-factor authentication on every system, including cloud root and break-glass accounts
• Single sign-on for anything that supports it, so joiner and leaver evidence comes from one place
• Documented onboarding with an access request record per person
• Offboarding within a stated time, evidenced with timestamps
• Quarterly access review with a record of who reviewed it and when
• Change management: pull requests reviewed before merge, with the record kept
• Deployment approvals for production, separated from the person who wrote the change where headcount allows
• Centralised logging with a stated retention period, actually retained
• Alerting that a human sees, with evidence of triage
• Vulnerability scanning on a schedule, with remediation timelines by severity
• Patching process with a stated window per severity
• Backups running, and a restore that was actually tested with a date on the test
• Encryption in transit and at rest, documented per data store
• Incident response plan, and one tabletop exercise with notes
• Annual risk assessment, written down, with owners against the risks
• Vendor inventory with a criticality rating and reviewed reports for the critical ones
• Security awareness training completed, with a completion record per person
• Background checks where your policy says you do them
• Policy set written, approved and acknowledged by staff with dates
• Business continuity and disaster recovery plan, with a test record
• Asset inventory covering endpoints and production infrastructure
• Endpoint protection and disk encryption on company laptops, centrally verifiable

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Phase three: the observation window

Three to twelve months of calendar time, and almost no work if phase two was done properly. The window is the stage nobody can shorten, which is why it should open as early as the control set allows. How the window works covers choosing the length.

0 of 0 done · Reset

• Window start date fixed and agreed with the audit firm
• Evidence captured as it is produced, not reconstructed at the end
• Every periodic control actually performed inside the window at its stated frequency
• Penetration test booked and completed, with remediation tracked
• System description drafted, naming regions, subservice organisations and commitments
• Monthly check that nothing quietly stopped running

Phase four: fieldwork and the report

Four to ten weeks from the end of the window to a signed report, assuming your first evidence submission is complete. It usually is not, and that is what turns four weeks into ten.

0 of 0 done · Reset

• Licensed CPA firm engaged, with the signing partner named
• Engagement letter signed, with the period dates and exclusions in it
• Request list answered completely on the first pass, with dates visible in every artefact
• Walkthroughs scheduled with the people who actually perform the controls
• Management assertion drafted and signed by an officer
• Draft report reviewed, including every exception and its management response

The Canadian items nobody puts on these lists

None of the following is a SOC 2 requirement. A Canadian buyer or regulator will ask about all of them anyway.

0 of 0 done · Reset

• Named accountable individual for privacy, published, as PIPEDA expects and Law 25 requires
• Data inventory covering what personal information you hold and where it physically sits
• Privacy impact assessment for personal information leaving Quebec, if you have Quebec users or staff
• Confidentiality incident register open, even while empty
• Retention schedule with a period per data category, enforced in the product
• A written answer to the data residency question before a buyer asks it
• Public subprocessor list with the processing country against each entry

The detail is on SOC 2 and PIPEDA, SOC 2 and Law 25, and data residency. A firm running your readiness that has not raised any of them is running an American playbook.

What is deliberately not on this list

A compliance platform. It is a genuine time saver at forty people and up, and under about twenty staff with one cloud account a spreadsheet and a disciplined owner will get you through a first audit for nothing. Where that line actually sits is the page to read before you spend $12,000 CAD a year on tooling to solve a problem you may not have.

Also missing: anything that promises a timeline shorter than the observation window. No item on any checklist changes the fact that a Type 2 examines a period that has already run.