SOC 2 readiness means your selected controls are documented and produce auditor-grade evidence on demand; if they don't, the next move is a gap analysis, not an audit booking. Readiness is judged against the AICPA Trust Services Criteria, and the test that matters is whether an auditor can sample your evidence and get a clean answer.
TL;DR:
- Run a gap analysis 4 to 6 months before the target audit, then schedule readiness 2 to 4 weeks before fieldwork, after remediation.
- Treat any control whose owner cannot produce matching evidence within 30 minutes as informal, and assign one named owner plus an indexed evidence record.
- Prioritize production access, change control, and tested backups before lower risk fixes, because gaps in these areas can prevent fieldwork from starting.
- For a Type 2 audit, rerun the control inventory 30 to 60 days before observation begins and freeze scope once that period starts.
Table of Contents
- What a SOC 2 readiness assessment is and why it matters
- Gap analysis versus readiness assessment: differences and timing
- Step-by-step SOC 2 readiness checklist to run internally
- Key controls auditors test and exactly what evidence to gather
- Timeline and cost drivers for gap analysis, readiness assessments and SOC 2 audits
- How Anvay approaches SOC 2 readiness: GAPZe to remediation to readiness check
- One practical takeaway to reduce audit risk
- Anvay services for SOC 2 readiness
- FAQ
- Sources
- Primary references and standards
What a SOC 2 readiness assessment is and why it matters
A readiness assessment is a pre-audit diagnostic, usually run by a service auditor or external assessor, that checks whether your controls and evidence will hold up once formal fieldwork starts. It can be performed internally by your own team or externally by a specialist, though an external view tends to catch blind spots that internal reviewers miss because they already know the workarounds.
The output is practical rather than theoretical:
- A gap register listing every control and its current status
- A remediation roadmap with owners and deadlines
- A readiness score indicating how close you are to audit-ready
Readiness assessments sit late in the project, close to fieldwork, while a gap analysis runs much earlier to find the work that still needs doing.
Gap analysis versus readiness assessment: differences and timing
These two exercises get conflated constantly, but they answer different questions at different points in the calendar. A gap analysis is a control-by-control inventory; a readiness assessment is a final check before an auditor walks in.
- Documented with evidence: the control exists, operates, and has a sampleable artefact behind it.
- Informal: the control probably happens, but there's no record an auditor could inspect.
- Missing: the control doesn't exist in any form yet.
Run the gap analysis 4 to 6 months before your target audit date, while there's still time to build evidence trails. Schedule the readiness assessment 2 to 4 weeks before fieldwork, once remediation is largely finished.
Pro Tip: Never schedule a readiness assessment before remediation is done. It just produces a low score on an unprepared programme and burns assessor time you'll need later.
The sequencing matters because stage-one gaps (access, change control, backups) can stop an audit before it starts, while later-stage gaps tend to produce findings rather than blockers.
Step-by-step SOC 2 readiness checklist to run internally
Most teams can run this checklist with internal staff before bringing in outside help for the harder gaps.
- Define scope and select Trust Services Criteria. Decide which of the criteria apply to your systems and services, informed by the AICPA Trust Services Criteria.
- Build a control inventory. List every control you believe is in place and map each one to the relevant criterion.
- Classify each control. Use the three-state model: documented with evidence, informal, or missing.
- Collect evidence and apply the 30-minute rule. If a control owner can't produce the artefact for a given control within half an hour, treat it as informal rather than documented, since that's effectively how an auditor will judge it.
- Prioritise by audit impact. Fix the controls that can block fieldwork before spending time on lower-risk findings.
- Re-run the inventory 30 to 60 days before the Type 2 observation period starts, then book the readiness assessment 2 to 4 weeks before fieldwork begins.
A few things make this checklist work rather than stall:
- Assign a named owner to every control, not a team or department.
- Keep an evidence index that maps each artefact to its control ID, which is exactly how an auditor cross-references samples.
- Freeze scope changes once the observation period for a Type 2 audit begins.
Readiness scoring tends to fall into four zones, including an audit-ready zone and zones indicating increasing levels of gaps and blockers. These bands give you a quick way to track progress between gap analysis and readiness assessment rather than guessing at how close you are.
Key controls auditors test and exactly what evidence to gather
Auditors don't weigh every control equally. A handful decide whether fieldwork proceeds smoothly or stalls on day one.
- MFA on production access (CC6.1): gather configuration screenshots, the written policy, and authentication logs showing enforcement over time.
- Same-day access revocation (CC6.2): pair the HR termination record with the system revocation timestamp; a gap of even a day between the two is a common finding.
- Peer-reviewed pull requests (CC8.1): keep PR logs showing reviewer IDs and a record of any exceptions where code shipped without review.
- Tested backup restores (A1.2): produce a restore report stating the date, the scope of data restored, and a sign-off from whoever verified it.
- Security awareness training (CC2.2): retain attendance logs, versioned training content, and assessment scores where quizzes were used.
Pro Tip: Missing or undocumented evidence for access, change control, or backup restores often causes the showstoppers; training gaps usually generate findings rather than halting an audit outright.
Evidence quality isn't just about having a document. Auditors judge provenance (who produced it), design (is the control even capable of meeting the criterion), operation (does it run as intended), and whether the artefact is sampleable with a clear timestamp.
Timeline and cost drivers for gap analysis, readiness assessments and SOC 2 audits
Planning realistically means separating the three phases rather than treating "SOC 2" as one block of work. A gap analysis typically runs 2 to 6 weeks depending on scope, while a readiness assessment is a tighter 1 to 2 week exercise once remediation is done. Type 1 audits assess design at a point in time and move faster; Type 2 audits assess operating effectiveness over an observation window, which stretches the overall timeline considerably.
Cost and duration both swing on a few factors:
- How many Trust Services Criteria you've included in scope
- How mature your controls already are before you start
- Whether remediation is done by consultants or absorbed by in-house staff
- How available control owners are to produce evidence on request
Freeze scope before the observation period starts, and re-run your control inventory close to that start date so nothing drifts unnoticed.
How Anvay approaches SOC 2 readiness: GAPZe to remediation to readiness check
Our GAPZe assessment runs a control-by-control inventory against recognised frameworks and produces a gap register with named owners and priority rankings, so remediation starts on the controls that actually block an audit. From there, we offer short inventory engagements, focused remediation sprints for specific control gaps, or a pre-fieldwork readiness check once your evidence trail is built. Each engagement is scoped before it starts, with deliverables and timescale agreed upfront.
One practical takeaway to reduce audit risk
If you take one thing from this: assign a named owner to every control and make sure that owner can pull the matching evidence inside 30 minutes. That single habit shortens fieldwork and cuts exceptions more than almost anything else you'll do.
— Achal
Anvay services for SOC 2 readiness
Our GAPZe assessment gives you a scoped gap inventory with owners and priorities attached, so you know exactly what to fix before an auditor ever sees it. For teams that need hands-on remediation, our cybersecurity consulting services cover compliance support, GRC and risk work, and fractional CISO cover where you need a steady hand through the whole process. Initial engagements are scoped around current control maturity, with clear deliverables and a timescale agreed before work starts. Get in touch to request a scoped gap inventory or a pre-fieldwork readiness check.
FAQ
What are the 5 principles of SOC 2?
The five Trust Services Criteria behind SOC 2 are security, availability, processing integrity, confidentiality, and privacy. Most audits scope security as mandatory and add the others based on the services being assessed, following the AICPA Trust Services Criteria.
What does SOC 2 compliance mean?
SOC 2 compliance means your organisation's controls meet the relevant Trust Services Criteria and that an independent auditor can verify this through sampled, timestamped evidence. It isn't a certification you hold permanently; it's tied to the audit report covering a specific period.
What is a SOC 2 compliance checklist?
A SOC 2 checklist walks through scoping the relevant criteria, inventorying controls, classifying each one as documented, informal, or missing, then collecting evidence and remediating gaps by audit impact. The strongest checklists finish with a readiness assessment close to fieldwork to confirm nothing has drifted.
What is SOC 1 and SOC 2 and SOC 3?
SOC 1 covers controls relevant to a client's financial reporting, while SOC 2 covers security, availability, processing integrity, confidentiality, and privacy controls judged against the Trust Services Criteria. SOC 3 is a shorter, publicly shareable summary of a SOC 2 report, without the detailed testing results.
Sources
Primary references and standards
This article draws on the AICPA Trust Services Criteria and on practitioner gap analysis guidance covering readiness scoring, evidence rules, and auditor sampling expectations.