SOC 2 checklist for startups: 20 items for a first audit

Which decisions come first?

• 1 Owner named for the SOC 2 programme.
• 2 Report type agreed: Type I first, or Type II.
• 3 Trust Services Criteria chosen (Security plus any others).
• 4 Scope written down: product, systems, locations of data, people.
• 5 Path and tool chosen: expert-guided or self-serve.

What about people?

• 6 Everyone in scope has signed the policies they must follow.
• 7 Security awareness training completed and recorded.
• 8 Onboarding and offboarding steps written and followed, with records.
• 9 Background checks done where your policy requires them.

Which systems items matter most?

• 10 Single sign-on and multi-factor authentication on critical systems.
• 11 Company devices managed, encrypted and tracked.
• 12 Logging and monitoring on production systems, with alerts someone reads.
• 13 Code changes reviewed and approved before production.
• 14 Backups running and a restore tested.

Which policies and records are needed?

• 15 Core policies written, approved by leadership and dated.
• 16 Risk assessment completed and recorded.
• 17 Vendor list with reviews of the vendors that handle customer data.

What do you need for the audit itself?

• 18 Auditor chosen: a licensed CPA firm, enrolled in AICPA peer review, with its relationship to your tool vendor understood.
• 19 Evidence for manual controls collected, not only automated ones.
• 20 Readiness review done, and audit or observation period dates agreed.

How does a tool change this list?

A compliance tool turns many of these items into tracked tasks and collects evidence for items 10 to 14 from connected systems. It does not choose your scope or your auditor. If you have no security lead, an expert-guided tool also takes on items 1 to 5 with you.