SOC 2 Readiness Assessment: Evaluating Your Starting Point

Key Takeaways

Point	Summary
Purpose	Identify gaps between current state and SOC 2 requirements
Timing	Conduct before starting formal SOC 2 engagement
Outcome	Clear roadmap for implementation work needed
Benefit	Avoid surprises during the actual audit
Scope	Covers controls, policies, evidence collection, and processes

Quick Answer: A SOC 2 readiness assessment evaluates your current security controls, policies, and processes against SOC 2 requirements. It identifies gaps that need to be addressed before your audit, helping you plan implementation work and set realistic timelines.

What Is a Readiness Assessment?

A readiness assessment is a structured evaluation that compares your current security environment to SOC 2 Trust Services Criteria requirements. It answers the question: "How prepared are we for a SOC 2 audit?"

What It Covers

Area	What's Evaluated
Policies	Do required policies exist and are they current?
Controls	Are key controls implemented and operational?
Evidence	Can you demonstrate control operation?
Processes	Are supporting processes documented and followed?
Technology	Is security tooling in place?
People	Are roles and responsibilities defined?

Why Conduct a Readiness Assessment

Benefits

For planning:

• Understand the scope of work ahead
• Set realistic timelines
• Identify resource requirements
• Prioritize implementation efforts

For budgeting:

• Understand what investments are needed
• Identify tooling requirements
• Plan for any remediation work

For the audit:

• Avoid surprises during formal audit
• Identify issues early when they're easier to address
• Build confidence in your control environment

Key Assessment Areas

1. Organizational Controls

Control Area	Questions to Consider
Governance	Is there security oversight from leadership?
Roles	Are security responsibilities defined?
Risk management	Do you have a risk assessment process?
Vendor management	How do you assess and monitor vendors?

2. Access Controls

Control Area	Questions to Consider
Identity management	How are accounts provisioned and deprovisioned?
Authentication	Is MFA enabled for critical systems?
Authorization	Are access rights based on least privilege?
Access reviews	Do you periodically review access?
Privileged access	How is admin access managed?

3. Change Management

Control Area	Questions to Consider
Change process	How are changes requested and approved?
Code review	Is code reviewed before deployment?
Testing	Are changes tested before production?
Deployment	Is there a controlled deployment process?
Rollback	Can changes be rolled back if needed?

4. Security Operations

Control Area	Questions to Consider
Vulnerability management	Do you scan for and remediate vulnerabilities?
Security monitoring	Are systems monitored for security events?
Incident response	Is there a defined incident response process?
Penetration testing	When was your last pen test?

5. Data Protection

Control Area	Questions to Consider
Encryption at rest	Is data encrypted in databases and storage?
Encryption in transit	Is TLS used for data transmission?
Data classification	Do you classify data by sensitivity?
Backup	Are backups performed and tested?

6. Business Continuity

Control Area	Questions to Consider
BC/DR plans	Do documented plans exist?
Recovery objectives	Are RTO/RPO defined?
DR testing	Have plans been tested?
Redundancy	Is infrastructure appropriately redundant?

7. Human Resources

Control Area	Questions to Consider
Background checks	Are checks performed on new hires?
Security training	Do employees receive security training?
Onboarding	Is there a security onboarding process?
Offboarding	Is access promptly removed at termination?

Readiness Assessment Process

Step 1: Define Scope

Before assessing, determine:

• Which systems and services will be in SOC 2 scope
• Which Trust Services Criteria you plan to include
• What third parties are involved

Step 2: Gather Information

Collect existing documentation:

• Current policies and procedures
• System architecture diagrams
• Access control configurations
• Security tool deployments
• Previous audit or assessment reports

Step 3: Conduct Evaluation

For each control area:

• Determine if controls exist
• Assess if they're operating effectively
• Identify evidence that can demonstrate operation
• Note gaps or deficiencies

Step 4: Document Findings

Create a gap analysis showing:

• Current state vs. required state
• Prioritized list of gaps
• Recommended remediation actions
• Estimated effort for each gap

Step 5: Develop Roadmap

Based on findings:

• Prioritize remediation work
• Estimate timeline for each item
• Identify dependencies
• Plan resource allocation

Common Gaps Identified

Policy Gaps

Common Issue	Impact
Missing policies	Core policies not documented
Outdated policies	Policies don't reflect current practices
Unsigned policies	No evidence of acknowledgment
Generic policies	Policies not tailored to organization

Technical Gaps

Common Issue	Impact
No MFA	Authentication below SOC 2 expectations
Missing encryption	Data protection gaps
No vulnerability scanning	Security monitoring gaps
Manual evidence collection	Difficulty demonstrating controls

Process Gaps

Common Issue	Impact
Informal access reviews	No documented review process
Ad-hoc change management	Changes not consistently approved
No incident response	Missing formal response procedures
Inconsistent offboarding	Access not promptly removed

Readiness Scoring

Many organizations find it helpful to score readiness:

Example Scoring Approach

Score	Description
0	Control doesn't exist
1	Control partially exists but not documented
2	Control exists and documented but not consistently followed
3	Control exists, documented, and consistently followed
4	Control mature with evidence of operation

Interpreting Scores

Overall Score	Readiness Level
Mostly 0-1	Significant work needed
Mostly 2	Moderate work needed
Mostly 3	Minor refinements needed
Mostly 4	Audit ready

Self-Assessment Checklist

Essential Controls

• Is MFA enabled for production systems?
• Is there a defined access request/approval process?
• Do you have documented security policies?
• Is encryption enabled at rest and in transit?
• Do you perform regular vulnerability scanning?
• Is there a documented change management process?
• Do you have an incident response plan?
• Are backups performed and tested?
• Do employees receive security training?
• Do you review and terminate access for departing employees?

Evidence Capability

• Can you show who has access to what systems?
• Can you demonstrate code review before deployment?
• Can you show vulnerability remediation?
• Can you produce security training completion records?
• Can you show backup restoration tests?

What Happens After Assessment

If Mostly Ready

• Begin formal SOC 2 engagement
• Address minor gaps during implementation
• Start observation period quickly

If Moderate Work Needed

• Prioritize critical gaps
• Implement essential controls first
• Start SOC 2 engagement once foundation is solid

If Significant Work Needed

• Focus on foundational security first
• Develop phased implementation plan
• Consider timeline implications

Professional vs. Self-Assessment

Self-Assessment

Pros:

• No cost
• Can start immediately
• Team gains understanding

Cons:

• May miss issues
• No external validation
• Can be time-consuming

Professional Assessment

Pros:

• Expert perspective
• Comprehensive coverage
• Actionable recommendations

Cons:

• Additional cost
• Requires coordination
• May identify more work than expected

The Bastion Approach

We include a comprehensive readiness assessment as part of our SOC 2 engagement:

• Gap analysis - Structured evaluation of your current state
• Prioritized roadmap - Clear plan for what needs to be done
• Effort estimation - Understanding of the work ahead
• Expert perspective - Insights from doing this repeatedly

This assessment informs our implementation plan and helps ensure no surprises during your audit.

---

Want to understand where you stand with SOC 2 readiness? Talk to our team

---

Sources

• AICPA Trust Services Criteria - Control objectives for SOC 2 evaluation
• AICPA SOC 2® Guide - Framework for assessing control design and operation