Free SOC 2 readiness assessment
How ready are you for a SOC 2 Type II audit?
Answer 32 yes-or-no questions about your controls. You get a readiness score right away, scores for each area, and a full report by email with what to fix first, mapped to the SOC 2 Trust Services Criteria.
How ready are you for SOC 2 Type II?
32 questions across 8 control areas. About 8 minutes. You see your score right away, and we'll email you the full report with what to fix first.
Your progress is saved in this browser, so you can come back to it.
What it covers
Eight control areas auditors test in a Type II audit
Policies and people
SOC 2 starts with written policies and the people processes around them.
5 questions
Risk, vendors and scope
Auditors want to see that you know your system, your risks and who you depend on.
4 questions
Access control
Access is where most SOC 2 exceptions come from. Auditors test it closely.
6 questions
Data protection
How customer data is protected at rest, in transit and on company devices.
4 questions
Monitoring and incidents
Whether you'd notice a problem, and what you'd do about it.
5 questions
Change management
How code and infrastructure changes reach production.
3 questions
Availability and recovery
Whether you can keep running, and recover when something fails.
3 questions
Type II evidence
A Type II report tests your controls over months. This is where readiness turns into proof.
2 questions
FAQs
About the assessment
What is a SOC 2 readiness assessment?
A SOC 2 readiness assessment checks your current security controls against what a SOC 2 auditor will test, so you can find and fix gaps before the audit. Ours is a free self-assessment focused on SOC 2 Type II.
How is the readiness score calculated?
Each of the 32 controls is weighted by how closely auditors test it and how often it causes exceptions. Yes earns full credit, Partly earns half, and No or Not sure earn none. The score is the share of the total weight you earn.
Is this assessment an audit?
No. It's a self-assessment to help you plan. Only an independent CPA firm can perform a SOC 2 audit and issue a report, and the score doesn't predict an auditor's opinion.
What happens to my answers?
Your answers are saved only in your browser so you can come back to them. If you ask for the full report, we email it to you and send a copy to our team so we can follow up. We don't sell your information.
Which SOC 2 criteria does the assessment cover?
It covers the Security criteria every SOC 2 report includes (CC1 to CC9), plus availability basics (A1), across policies and people, risk and vendors, access control, data protection, monitoring and incidents, change management, availability and Type II evidence.
Want an engineer to look at your results?
Pick a few times that work for you. We'll call to learn about your environment and timeline, then send a written proposal if we're a good fit.