Guide
SOC 2 compliance checklist
SOC 2 is an attestation report issued by an independent CPA firm against the AICPA Trust Services Criteria. Use this checklist to work through the five criteria and to read a vendor's SOC 2 Type II report without missing the parts that carry the risk.
The five Trust Services Criteria
Security is mandatory; the other four are included only when they are relevant to the service. Check which ones the report covers before you rely on it.
Security (the common criteria)
The only mandatory criterion. Every SOC 2 report covers it.
- Logical access controls: provisioning, deprovisioning, MFA, and privileged access review
- Network and infrastructure protection, including encryption in transit and at rest
- Change management and secure development practices
- Vulnerability management, monitoring, and documented incident response
- Risk assessment and vendor/sub-service organization oversight
Availability
Included when uptime commitments matter to your use of the service.
- Capacity planning and performance monitoring
- Backup, restoration testing, and recovery objectives (RPO/RTO)
- Business continuity and disaster recovery plans that were actually exercised
- Environmental and hosting resilience for the underlying infrastructure
Processing integrity
Relevant when the vendor computes, transforms, or transacts on your data.
- Input validation and completeness/accuracy checks
- Error detection, correction, and reprocessing procedures
- Job scheduling and pipeline monitoring with alerting
- Quality assurance over outputs delivered to customers
Confidentiality
Relevant when you send the vendor non-public business information.
- Classification of confidential data and handling requirements
- Encryption, key management, and access restriction to confidential stores
- Confidentiality commitments flowed down to employees and sub-processors
- Secure disposal and retention limits for confidential information
Privacy
Relevant when the vendor processes personal information.
- Notice, consent, and choice mechanisms for data subjects
- Collection limited to stated purposes, with lawful basis documented
- Access, correction, and deletion request handling
- Disclosure to third parties and cross-border transfer controls
How to read a SOC 2 Type II report
Type I or Type II?
Type I tests design at a point in time. Type II tests operating effectiveness across a period — usually 3 to 12 months. For a vendor that touches production data, insist on Type II.
Does the period still apply?
Check the observation period end date and the report date. A report covering a window that ended more than a year ago is stale; ask for a bridge letter or the current report.
What is in scope?
The scope section names the systems, products, and locations covered. Confirm the product you are buying is actually in scope — not just the vendor's flagship platform.
Which criteria are covered?
Security is always covered. If you depend on uptime or the vendor handles personal data, availability and privacy should be in scope too.
Are there exceptions?
Read the auditor's tests of controls for noted exceptions and management responses. A qualified opinion, or repeated exceptions in access control, is a material finding.
Complementary user entity controls
These are the controls the report assumes you operate — SSO enforcement, admin review, key rotation. They are your obligations, not the vendor's.
Sub-service organizations
Carved-out sub-service providers are excluded from testing. Note which ones and confirm their own audit status separately.
Automate the SOC 2 report review
Upload a vendor's SOC 2 report, security whitepaper, or trust center URL and ComplianceCheckr grades it against these controls — quoting the source text as evidence, marking anything unsupported as unknown rather than guessing, and saving the result as a dated record you can approve, deny, or revisit.