SOC 2 Compliance Checklist: Requirements by Trust Services Criteria

A SOC 2 compliance checklist starts with the security criteria every report covers, the common criteria CC1 to CC9, then adds availability, confidentiality, processing integrity or privacy only if customers need them. For a small company the core is MFA, endpoint protection, logging, access reviews, change control, vendor reviews, incident response, tested backups and proof of each.

This is the checklist we work from in our SOC 2 readiness services, organized the way the AICPA organizes the criteria. If you have not chosen a report yet, read SOC 2 Type 1 vs Type 2 first, and for budgeting, see our SOC 2 audit cost guide.

What are the SOC 2 requirements?

SOC 2 has no fixed control list. Its requirements are the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022, and the AICPA calls them outcome-based: they describe what your controls must achieve, not which tools to buy. The criteria fall into two groups:

• Common criteria, CC1 to CC9. CC1 to CC5 carry the 17 principles of the COSO internal control framework, grouped as control environment, communication and information, risk assessment, monitoring activities and control activities. CC6 to CC9 add logical and physical access, system operations, change management and risk mitigation. On their own, the common criteria are the complete set for security.
• Additional criteria. Availability (A1), confidentiality (C1), processing integrity (PI1) and privacy (P1 to P8) each add criteria on top of the common criteria.

Each criterion comes with points of focus, but the AICPA says using the criteria does not require an assessment of whether each point of focus is addressed, and some may not suit your company at all. Treat them as prompts, not as the checklist.

Which Trust Services Criteria apply to your company?

A smaller scope is cheaper and still credible. Add a category because a customer asked for it, not because it looks thorough.

What does the SOC 2 checklist include for the security criteria?

These are the controls we expect a small company to run for each part of the common criteria, and the evidence auditors commonly request. The criterion numbers are the AICPA's.

Some controls serve several criteria. Security awareness training supports CC1.4, which covers developing competent people, and CC2.2, which covers communicating security information internally. Tested backups support recovery under CC7.5 and the availability criteria below. Our vendor risk management guide goes deeper on CC9.2, and our incident response plan steps cover CC7.4.

What do the other Trust Services Criteria add?

What evidence will the auditor ask for?

For a Type 1, the auditor looks at whether each control is suitably designed as of the report date, so policies, configurations and procedures carry most of the weight. For a Type 2, the auditor also tests whether controls operated across the period, so you need records from throughout it: access reviews from each quarter, change tickets from different months, restore tests on the dates your schedule promised. Three habits make that easy:

• Keep an evidence calendar that names who produces each record and when.
• Export reports straight from the systems that run the controls, with dates visible, instead of rebuilding them later.
• Store final versions only. A draft policy or an undated screenshot proves little.

How do you work through the SOC 2 checklist?

We run the work in nine steps:

1. Scope the system. Choose the services, systems, people and vendors the report will cover, and the Trust Services Criteria your customers need beyond security.
2. Run a gap assessment. Compare your current controls with each criterion in scope and turn every gap into a dated task with an owner.
3. Write the policies. Write the security, access, change, incident, vendor and continuity policies your team will follow, and have staff acknowledge them.
4. Implement the controls. Configure MFA, device management, endpoint protection, logging, backups and the other controls the gap list calls for.
5. Collect evidence on a schedule. Keep an evidence calendar so access reviews, scans, restore tests and change records are produced and stored on time.
6. Choose an independent CPA firm. Engage a licensed CPA firm that did not build your controls, and agree on the scope, criteria and timing.
7. Get a Type 1 report if you need one soon. If a customer needs a report quickly, the CPA firm examines the design of your controls as of a date.
8. Run the observation period. Operate every control through the agreed period and keep the records, because the auditor samples across it.
9. Complete the Type 2 examination. The CPA firm tests the controls, you answer its requests from the evidence library, and the firm issues the report.

The AICPA notes that a CPA firm that designs or implements an attest client's systems can face threats to its independence, which is why step six names a firm that did not build your controls. We handle steps one to five and support the rest, starting with a free remote external penetration test within an agreed scope. For managed clients we already run many of the controls in Microsoft 365, Entra ID and Intune, so the evidence comes from systems we operate every day.

Frequently asked questions

Is there an official SOC 2 checklist?

No. The AICPA publishes the Trust Services Criteria, which are outcome-based, and leaves the controls to each company. Its points of focus describe characteristics of each criterion but are not required items. A checklist like the one above translates the criteria into controls and evidence for a typical small company; your scope may need more or less.

Do we need every Trust Services Criteria category?

No. Every SOC 2 covers the common criteria, which are the security category. Availability, confidentiality, processing integrity and privacy are optional and should be added only when customers need them, because each adds controls, evidence and audit fees.

What tools does SOC 2 require?

None by name. The criteria describe what controls must achieve, such as restricting logical access or detecting malicious software, so you can meet them with the tools you already run. A typical small company uses its identity provider, device management, endpoint protection, a logging platform and a ticketing system, plus a compliance platform if they want help tracking evidence.

Can a small company with no IT staff get SOC 2 ready?

Yes, with an outside provider running the controls and a named owner inside the company for the decisions only the business can make, such as who gets access and which vendors are approved. The provider builds and operates the controls; an independent CPA firm audits them.

Sources and further reading

• AICPA: 2017 Trust Services Criteria, with revised points of focus (2022): the common and additional criteria, the role of points of focus and the independence note, checked October 2026.
• AICPA: Mappings relevant to the trust services criteria: the criteria described as outcome-based, checked October 2026.
• AICPA Guide: SOC 2 Reporting on an Examination of Controls at a Service Organization: what a SOC 2 examination covers, checked October 2026.
• AICPA & CIMA: SOC suite of services, checked October 2026.