Skip to main content

    Free framework self-check

    SOC 2 Self-Check

    A customer has asked for a SOC 2 report, or your team is moving from a first examination to a longer review period. This free self-check asks ten questions about the controls and records behind your service. It helps you identify questions to resolve before a readiness assessment or an independent CPA examination.

    The risk
    The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
    Start the SOC 2 self-checkTalk to us
    a readiness gap register beside a bundle of sampled control-testing evidence.

    How the self-check works

    1. You give a first name, company and work email. Your session is stored and a resume link is sent by email.
    2. An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
    3. You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
    4. Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.

    The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.

    Who it is for

    SaaS and service companies preparing for a first SOC 2 or moving from Type I to Type II. It is useful for founders, security leads and operations teams who need to understand what is already working and what still needs attention. Choose answers that describe today's practices, including areas you have not checked.

    Trust Services Criteria

    The five themes covered

    Security and access control
    How people receive, change and lose access to systems and customer data. Consider approval records, privileged accounts, multifactor authentication and whether access reviews cover the people and systems supporting your service.
    Change management and SDLC
    How software changes move from development into production. Think about code review, test records, release approvals and emergency changes. A written process is only part of the picture; teams need records of using it.
    Availability and incident response
    How your team detects disruption, restores service and handles security incidents. Consider backup tests, recovery responsibilities, incident exercises and the commitments you make to customers. Availability criteria depend on what the examination covers.
    Vendor and subservice organization management
    Which providers support your service and what responsibilities remain with your team. Consider vendor reviews, contracts, relevant assurance information and changes to important suppliers. Another provider's report does not cover every responsibility in your environment.
    Monitoring, logging and evidence retention
    Whether useful logs, alerts and control records are available for the relevant period. Think about who follows up exceptions and how records are retained. A Type II examination considers controls operating over time.

    From self-check to assessment

    A readiness review looks beyond your answers to policies, system descriptions and records. It can help your team find missing controls or documentation before the examination. For example, an access review may be scheduled but lack a complete user list. We help prepare that work; your CPA firm determines its examination procedures, conclusions and reporting.

    AuditPartners provides preparation and audit delivery support. An independent CPA firm performs the SOC 2 examination and decides the conclusions in its report.

    Guides and assessment services

    The next step

    Start the SOC 2 self-check

    Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.

    Start the self-checkTalk to us