SOC 2 readiness: prepare for an independent CPA examination

Authority

AICPA (American Institute of Certified Public Accountants) Trust Services Criteria (external site)

Type

Framework or voluntary standard

Current version, as of September 26, 2026

2017 Trust Services Criteria (With Revised Points of Focus – 2022). Criteria issued in 2017; points of focus revised in 2022. Version source for SOC 2 (external site)

• Service organizations whose customers ask for a SOC 2 report before they share data or sign a contract
• SaaS and professional-services firms that host, process, or support systems holding customer data
• Teams answering frequent customer security questionnaires that want an independent report to share
• Organizations that want to understand the gap before they engage and pay a CPA firm

Sources: AICPA: 2018 SOC 2 Description Criteria (With Revised Implementation Guidance – 2022); AICPA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)

Read the full guide: SOC 2 Type 1 vs Type 2: which report do you need?

• CC1: control environment
• CC2: information and communication
• CC3: risk assessment
• CC4: monitoring activities
• CC5: control activities
• CC6: logical and physical access controls
• CC7: system operations
• CC8: change management
• CC9: risk mitigation, including risks from vendors and business partners

Source: AICPA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)

Read the full guide: SOC 2 Trust Services Criteria explained, CC1 to CC9

• SOC 1 reports on controls at a service organization that are relevant to its customers' internal control over financial reporting (AT-C section 320).
• SOC 2 reports on controls relevant to security, availability, processing integrity, confidentiality, or privacy, measured against the Trust Services Criteria. It includes management's system description, and a Type 2 report also includes the service auditor's detailed tests of controls and results.
• SOC 3 covers the same Trust Services Criteria categories and contains an opinion on the operating effectiveness of controls, but without the detailed description of tests and results. The AICPA describes it as a general use report that can be freely distributed.

Sources: AICPA: System and Organization Controls (SOC) suite of services; AICPA & CIMA: SOC 3, SOC for Service Organizations: Trust Services Criteria for General Use Report; AICPA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)

• The types of services provided
• The principal service commitments and system requirements
• The components of the system: infrastructure, software, people, procedures, and data
• Identified system incidents that resulted from ineffective controls or caused a significant failure to meet commitments or requirements
• The applicable Trust Services Criteria and the related controls
• Complementary user entity controls: controls the service organization assumed its customers would operate
• Subservice organizations, described with either the inclusive method or the carve-out method
• Any criterion that isn't relevant to the system, and why
• For a Type 2 report, significant changes to the system and controls during the period

Sources: AICPA & CIMA: Illustrative SOC 2 report with illustrative system description; AICPA: 2018 SOC 2 Description Criteria (With Revised Implementation Guidance – 2022)

1. Decide between a Type 1 and a Type 2 report, and which services it covers
2. Define the system boundary, including subservice organizations and complementary user entity controls
3. Pick the Trust Services Criteria categories that match your customer commitments
4. Assess gaps against the common criteria (CC1 to CC9) and any added categories
5. Write and approve the policies your team will follow
6. Collect evidence that each control operates, and rehearse the requests a CPA firm is likely to make
7. Choose a licensed CPA firm and check its license and peer review

Sources: AICPA: 2018 SOC 2 Description Criteria (With Revised Implementation Guidance – 2022); AICPA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)

Read the full guide: SOC 2 readiness checklist: how to prepare for your report

1. 01

   Scope

   Confirm which services and systems are in scope, which Trust Services Criteria apply, and whether a Type 1 or Type 2 report fits what your customers ask for.

2. 02

   Assess gaps

   Compare your current controls and evidence with the criteria and points of focus, and rate each gap by risk and effort.

3. 03

   Plan remediation

   Agree on a prioritized plan. Your team decides on and implements the changes; we advise and review.

4. 04

   Rehearse evidence

   Review evidence samples and walk through key controls, so your team knows what a CPA firm is likely to ask for.

5. 05

   Hand off

   Prepare a readiness summary you can share with the CPA firm you select. That firm plans and performs its own examination.

• Readiness report with each gap rated by risk and effort
• Trust Services Criteria matrix mapped to your controls and evidence
• Prioritized remediation plan
• Policy and system-description recommendations for management's review
• Evidence request list and walkthrough notes

• Compliance · 12 min readSOC 2 readiness checklist: how to prepare for your reportA practical SOC 2 readiness checklist: set your system boundary, pick Trust Services Criteria, close control gaps, collect evidence and choose a CPA firm.
• Compliance · 10 min readSOC 2 Type 1 vs Type 2: which report do you need?SOC 2 Type 1 vs Type 2: what each report covers, how the Type 2 review period works, and how to decide which one your customers actually need first.
• Compliance · 10 min readSOC 2 Trust Services Criteria explained, CC1 to CC9The SOC 2 Trust Services Criteria explained: the five categories, the CC1 to CC9 common criteria, points of focus, and how to choose what goes in scope.
• Compliance · 10 min readISO 27001 vs SOC 2: differences and which to pursueISO 27001 vs SOC 2: certificate vs attestation report, who issues each, how scope and upkeep differ, and how to decide which to pursue first or do both.
• Testing · 10 min readPenetration testing types and how often to testPenetration test types and cadence: web app, API, external and internal network tests, and what PCI DSS, SOC 2, HIPAA and ISO 27001 say about frequency.
• Compliance · 6 min readIs SOC 2 a certification? Who can issue whatThere's no SOC 2 or HIPAA certification. Here's who can issue SOC 2 reports, ISO 27001 certificates, PCI DSS reports and CMMC results, and how to check.