SOC 2 Type II readiness · ISO/IEC 27001:2022
Is your SaaS ready for a SOC 2 Type II examination?
SOC 2 is not a certification: it is an attestation report in which a licensed CPA firm gives an opinion on management's description of a system and on the design (Type I, at a point in time) and operating effectiveness (Type II, over an observation period of typically 3-12 months) of controls against the AICPA Trust Services Criteria. US enterprise buyers routinely require a SOC 2 Type II report in vendor due diligence, so EU SaaS companies selling to the US often need one in addition to ISO/IEC 27001. This assessment paraphrases every common criterion (CC1-CC9), the Availability, Confidentiality and Processing Integrity criteria and the Privacy criteria in grouped form, plus audit readiness items (system description per DC 200, scope, subservice organisations, evidence). Each requirement gives the typical evidence auditors sample, common exceptions and the mapping to ISO/IEC 27001:2022, so an existing ISMS can be reused.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- Report: free summary PDF; with Pro the full report with action plan, guidance, control map, roadmap and Excel export.
57 requirements · 14 assessment areas · mapped to ISO 27001 · 60-120 minutes
Assessment areas
- CC1 – CC1 Control environment
Tone at the top: code of conduct, board oversight, structure and roles, competence, background checks and accountability (COSO principles 1-5). Tests rely heavily on HR populations: new hires, terminations and training completion; include contractors. - CC2 – CC2 Communication and information
Quality information for controls (inventories, complete populations), internal communication of policies and reporting channels, and external communication of commitments to customers (COSO principles 13-15). Contracts and the trust page define the commitments the report is measured against. - CC3 – CC3 Risk assessment
Objectives, a dated annual risk assessment including vendor and fraud risks, and assessment of significant changes (COSO principles 6-9). A risk assessment outside the observation period is an automatic exception. - CC4 – CC4 Monitoring activities
Ongoing and separate evaluations (continuous monitoring, internal review, annual penetration test) and timely remediation of deficiencies (COSO principles 16-17). - CC5 – CC5 Control activities
Selection of controls against risks, IT general controls and an approved, annually reviewed policy set (COSO principles 10-12). The SOC 2 control matrix built here drives the whole examination. - CC6 – CC6 Logical and physical access
Identity and MFA, provisioning and deprovisioning, least privilege and access reviews, physical access, disposal, boundary protection, encryption and anti-malware. The area with the most sampled tests and the most frequent exceptions (late deprovisioning, missed access reviews). - CC7 – CC7 System operations
Vulnerability and configuration management, logging and monitoring, incident triage, response and recovery. Auditors sample alerts, vulnerabilities and incidents and compare handling with your SLAs. - CC8 – CC8 Change management
Authorised, peer-reviewed, tested and approved changes to code, infrastructure and data, with separated environments and controlled emergency changes. The population of production changes is sampled in depth. - CC9 – CC9 Risk mitigation (vendors, business disruption)
Business continuity, DR and insurance for disruption risks, and vendor and business partner risk management including annual review of subservice organisations' SOC 2 reports. - A1 – A1 Availability
Capacity management, redundancy, backups, environmental protections and tested recovery against RTO/RPO. Include when customers rely on uptime commitments (SLA). - C1 – C1 Confidentiality
Identification, protection, retention and disposal of confidential information under confidentiality commitments (customer data, IP). Included in most B2B SaaS reports. - PI1 – PI1 Processing integrity
Complete, valid, accurate and timely processing of inputs, processing, outputs and storage. Relevant for transaction, financial, payroll or calculation services. - PRV – P Privacy (P1-P8)
Notice, choice and consent, collection, use and retention, access, disclosure and notification, quality, monitoring and enforcement of personal information. Grouped here; for EU companies much of the evidence comes from the GDPR programme. - AUD – Audit readiness (DC 200, scope, auditor, evidence)
Not a TSC category: practical prerequisites for a clean report - scope, system description per DC 200, CPA firm and report type, subservice organisations and CUECs, evidence collection and continuity (renewal, bridge letters).
Key dates and milestones
| Date | Source | Status | |
|---|---|---|---|
| Month 0 | SOC 2 path | Readiness assessment (this self-assessment or one by an advisor): scope and Trust Services Categories chosen, control matrix drafted, gaps identified, CPA firm shortlisted | Typical |
| Months 1-3 | SOC 2 path | Remediation: policies approved, SSO/MFA, MDM and EDR rolled out, change management and branch protection, logging and alerting, vendor reviews, risk assessment, system description drafted; evidence collection started | Typical |
| Month 3-4 | SOC 2 Type I | Optional Type I report as of a specific date (design and implementation only); fieldwork a few weeks, report usually 2-6 weeks later; often used to unblock sales while the Type II period runs | Typical |
| Months 3-15 | SOC 2 Type II | Type II observation period of 3 to 12 months (first report often 3-6 months, then rolling 12 months); all controls must operate and generate evidence throughout, including annual ones (risk assessment, pentest, BC/DR test, policy review, training) | Typical |
| Period end + 4-8 weeks | SOC 2 Type II | Auditor fieldwork and sample testing, management responses to exceptions, report issuance typically about 4-8 weeks after the end of the observation period | Typical |
| Every 12 months | SOC 2 Type II | Annual renewal with contiguous periods; bridge letter signed by management covers the gap between period end and the next report; annual review of subservice organisations' SOC 2 reports | Typical |
| 04/2017 | AICPA ASEC | 2017 Trust Services Criteria (TSP section 100) issued, aligned with the COSO 2013 Internal Control framework; replaced the 2016 TSPs for periods ending on or after 15/12/2018 | In force |
| 15/12/2018 | AICPA | Use of the 2017 TSC and of the 2018 Description Criteria (DC 200) required for SOC 2 reports covering periods ending on or after this date (descriptions as of 16/12/2018 or later) | In force |
| 10/2022 | AICPA | Revised points of focus for the 2017 TSC and revised implementation guidance for DC 200 published together with the updated SOC 2 Guide; criteria unchanged, points of focus expanded (e.g. privacy, data management, confidentiality of information beyond personal data) | In force |
| 28/10/2026 | AICPA ASEC | Exposure drafts of the proposed 2027 SOC 2 Trust Services Criteria and Description Criteria published: criteria merged, removed, added and reworded; new points of focus on AI (governance, model monitoring, prompt manipulation, data poisoning, training data, automated decisions) | Proposal |
| 15/01/2027 | AICPA ASEC | Comment deadline for the 2027 TSC and Description Criteria exposure drafts | Proposal |
| 31/12/2027 | AICPA ASEC | Proposed effective date: the 2027 criteria would apply to engagements beginning on or after this date, early adoption permitted (if approved as proposed); until then the 2017 TSC with 2022 points of focus remain the basis | Proposal |
Frequently asked questions
Is the SOC 2 Type II readiness self-assessment free?
Yes. The questionnaire, the scoring, the dashboard and a summary PDF are free and need no account; your answers stay in your browser and are never sent to our servers. An optional Pro pass (18 EUR for 45 days, all assessments) adds the full PDF report with prioritised action plan and guidance, the evidence tracker, comparisons with previous assessments, the cross-framework view and the Excel export.
Which standard is the SOC 2 Type II readiness assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Founders, CTOs, security and compliance leads of SaaS and service companies (including EU companies selling to US customers) preparing a first or renewed SOC 2 Type I or Type II examination; it is a self-assessment and does not replace a certification audit.
Is this a SOC 2 report or certification?
No. SOC 2 is an attestation report issued only by a licensed CPA firm after examining your controls (Type I at a point in time, Type II over an observation period of 3-12 months). This self-assessment is the readiness step before engaging an auditor: it shows gaps against the Trust Services Criteria, the evidence auditors usually request and the overlap with ISO/IEC 27001. GoToCertify is not affiliated with the AICPA.
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
- Swiss nFADP (nLPD) – Federal Act on Data Protection (FADP/nLPD/revDSG, SR 235.1) and Data Protection Ordinance (DPO/OPDa/DSV, SR 235.11) – mapped to ISO/IEC 27701:2025
- EU laws for Swiss companies – Scoping of GDPR, AI Act, NIS2, DORA and Cyber Resilience Act for non-EU (Swiss) companies – mapped to ISO/IEC 27001:2022
- NIST CSF 2.0 – NIST Cybersecurity Framework 2.0 (CSWP 29, 26/02/2024) - maturity by Function and Category, Current vs Target Profile - mapped to ISO/IEC 27001:2022
Self-assessment tool for information purposes only; it is not a SOC 2 examination or attestation and does not replace the judgement of a CPA firm. SOC 2 reports can only be issued by licensed CPA firms under AICPA attestation standards. GoToCertify is not affiliated with, endorsed by or sponsored by the AICPA; criteria are paraphrased and the official 2017 Trust Services Criteria and DC 200 published by the AICPA prevail. SOC 2 and SOC for Service Organizations are trademarks of their respective owners; other trademarks belong to their owners. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.