SOC 2 · Guide
SOC 2 compliance checklist: the phased checklist for UK firms (starting from ISO 27001)
SOC 2 compliance checklist: the phased checklist for UK firms (starting from ISO 27001)
Key takeaways
This SOC 2 compliance checklist runs in five phases: confirm the customer's ask, scope the system, close control and evidence gaps, prepare the audit and run the annual cycle. For a firm that already holds ISO 27001, most items adapt existing ISMS work rather than build something new. The step no effort can shorten is collecting evidence for every control across the Type 2 observation period.
- Scope decision
- Management decides which services and trust services categories a SOC 2 report covers, and should consider report users' needs, including their regulatory obligations, governance requirements and industry practices.
- Observation period
- AICPA guidance sets no generally accepted minimum period for a SOC 2 Type 2 report; it must be long enough for the auditor to opine on operating effectiveness and meet users' needs.
- Management's assertion
- A written statement attached to the system description in which management confirms the description is fairly stated and the controls were suitably designed and, for Type 2, operated effectively throughout the period.
- Licensed CPA
- SOC 2 is an examination-level attestation engagement, not a certification. Under US state law these engagements must be performed by licensed CPAs, so a licensed firm signs the report.
Your US prospect's security review has stalled on one line: "Please provide your SOC 2 report." You already hold ISO 27001, and the obvious question is how much of SOC 2 you have already done. This SOC 2 compliance checklist answers that, item by item, for UK B2B tech firms of 25 to 100 people.
The checklist runs in five phases: confirm what the customer actually needs, scope the system, close the gaps in controls and evidence, prepare for the audit, then run the annual cycle. Every item says whether an ISO 27001 ISMS already covers it, needs adapting, or is new work.
The items were chosen against one test. Each is something a service auditor will look for when examining your controls against the AICPA Trust Services Criteria, or a step where ISO 27001 does not ask for what SOC 2 needs. Generic security good practice that your ISMS already runs is left out.
What is on the SOC 2 compliance checklist?
The SOC 2 compliance checklist has twelve items across five phases. Two confirm the customer's ask, three scope the system, four close the gaps in controls and evidence, two prepare the audit and one keeps the cycle running. For an ISO 27001 holder, two items are largely covered, six need adapting and four are new.
For what SOC 2 is and how the report works, start with our SOC 2 overview. The table is the checklist itself; the sections below give each item the same three parts: what it is, when it matters and what to do.
| Item | Phase | What it is | ISO 27001 status |
|---|---|---|---|
| 1. Confirm what the customer is asking for | Confirm | The report type, the criteria and whether an alternative would do | New |
| 2. Agree the report type and period with leadership | Confirm | A Type 1 date or a Type 2 period, and who owns the project | Adapt |
| 3. Choose the service and the criteria in scope | Scope | Which service the report covers, and which categories beyond Security | Adapt |
| 4. Decide how each supplier is treated | Scope | Subservice organisations and the vendors your service relies on | Adapt |
| 5. Write the system description | Scope | Management's account of the system, prepared against DC 200 | New |
| 6. Map existing controls to the criteria | Controls and evidence | Each ISMS control linked to the criteria it meets | Adapt |
| 7. Close the criteria-specific gaps | Controls and evidence | Controls the criteria expect that the ISMS does not yet run | Adapt |
| 8. Bring policies into line with practice | Controls and evidence | Policies that describe what actually happens | Covered |
| 9. Switch every control to period evidence | Controls and evidence | Records for every occurrence across the observation period | Adapt |
| 10. Engage a licensed CPA firm from the UK | Audit | The firm that will examine your controls and sign the report | New |
| 11. Prepare management's written assertion | Audit | Leadership's signed statement about the description and controls | New |
| 12. Run the annual cycle | Annual cycle | Back-to-back periods and a yearly refresh of scope and description | Covered |
What should you confirm before starting SOC 2?
Before any SOC 2 work starts, confirm exactly what your customer will accept, then agree the report type and period with leadership. These two items take little effort and can change the size of the whole project. An ISO 27001 ISMS has no equivalent step, because a certificate's scope is set by you, not by a buyer.
1. Confirm what the customer is asking for
What it is. A short, written answer from the customer's security or procurement team: which report type they want, which trust services categories beyond Security, and whether your ISO 27001 certificate or an ISAE 3000 assurance report would satisfy them.
When it matters. Always, and first. A request for "SOC 2" in a questionnaire can be a default rather than a considered requirement.
What to do. Ask three direct questions in one email, and keep the reply. ICAEW describes ISAE 3000 (Revised) as the standard for assurance engagements other than audits or reviews of historical financial information, so it is a credible alternative to raise with the buyer.
The cheapest SOC 2 is the one scoped to what the customer actually asked for.
2. Agree the report type and period with leadership
What it is. A leadership decision on Type 1 or Type 2 and, for Type 2, the period the report will cover, with a named executive owner.
When it matters. Once item 1 is answered. The Journal of Accountancy's guide to SOC 2 engagements puts the choice with management, "depending on the needs of users", and notes there is "no generally accepted minimum useful period".
What to do. Record the decision, the reason and the owner in your ISMS management review minutes, so the governance trail you already keep carries the SOC 2 decision too.
How do you scope SOC 2 from an existing ISO 27001 ISMS?
Scope SOC 2 by choosing one service, the criteria that service's commitments call for, and a boundary drawn from your ISMS scope statement and supplier register. Then write the system description. An ISO 27001 holder adapts most of the scoping inputs, but the description itself is new, customer-facing work with its own AICPA criteria.
3. Choose the service and the criteria in scope
What it is. The service the report covers and the trust services categories in it. Security is always included; the AICPA's 2017 Trust Services Criteria also cover availability, processing integrity, confidentiality and privacy.
When it matters. Before any control work, because each added category adds criteria to meet and evidence to hold.
What to do. Start from your ISMS scope statement, then narrow it to the service the customer buys. Add a category only where a contract, service level or questionnaire answer commits you to it. The JofA guide adds that management should weigh report users' needs, "including their regulatory obligations".
4. Decide how each supplier is treated
What it is. A decision, provider by provider, on whether a supplier's controls are included in your report or carved out, plus the controls you expect each one to run.
When it matters. Whenever your service runs on a cloud host or another provider whose controls you rely on, which for a SaaS firm is almost always.
What to do. Start from the supplier register and assessments you keep under Annex A 5.19. Add a column for SOC 2 treatment, and collect each key provider's current assurance report before fieldwork.
5. Write the system description
What it is. Management's written account of the system in scope. The AICPA's description criteria (DC 200) are the benchmark for preparing and evaluating it.
When it matters. Before the auditor plans testing, because the description sets what will be tested.
What to do. Reuse your scope statement, asset inventory and supplier register for the components. Write the customer commitments and system requirements fresh; an ISMS rarely holds them in one place.
Most of SOC 2 is not new work for an ISO 27001 holder; it is the same work, written for a different reader.
Which SOC 2 controls and evidence does an ISO 27001 holder need to add?
An ISO 27001 holder usually adds a criteria mapping, a few criteria-specific controls and, above all, evidence that covers every occurrence across the observation period. Policies mostly carry over. The AICPA's own mapping compares ISO 27001 requirements with the relevant criteria, so the overlap is real, but a certificate is not a SOC 2 report.
6. Map existing controls to the criteria
What it is. A controls list in which each ISMS control is linked to the SOC 2 criteria it helps meet, with an owner and a frequency.
When it matters. Straight after scoping. It shows which criteria you already answer and which you do not.
What to do. Start from your Statement of Applicability and work criterion by criterion. The AICPA's mapping of the Trust Services Criteria to ISO 27001 is available to AICPA members. Map at the level of your own controls; do not copy anyone else's.
7. Close the criteria-specific gaps
What it is. The handful of controls the criteria expect that an ISMS may not run in the same form. Typical examples are communicating service commitments to customers, considering fraud risk explicitly and, where in scope, capacity planning or data disposal.
When it matters. After mapping, wherever a criterion has no control behind it.
What to do. Design each control as an outcome a tester can sample: who does what, how often, and which record it leaves.
8. Bring policies into line with practice
What it is. Your existing ISMS policies, checked so that each one describes what the team actually does.
When it matters. Before the period starts. The auditor tests controls against what your own documents say.
What to do. Reuse the policy set you hold for ISO 27001; our guide to ISO 27001 mandatory documents covers what that set contains. Fix any review frequency your records cannot support.
9. Switch every control to period evidence
What it is. Records for each occurrence of every in-scope control across the observation period, not a sample chosen by you.
When it matters. From the first day of a Type 2 period, because the auditor tests whether controls ran throughout it.
What to do. Move evidence into the systems that do the work: tickets, identity provider logs, training records. Run each periodic control once before the period opens, so its first occurrence inside the window is not its first ever. The SOC 2 readiness assessment tests whether you are ready to open the window.
A policy shows intent; only a record from inside the period shows the control ran.
What does the SOC 2 audit phase add to the checklist?
The audit phase adds two items: engaging a licensed CPA firm to examine your controls, and preparing management's written assertion. ISO 27001 holders know how to manage an external auditor and sign off formal statements, but the firm, the licence and the assertion are specific to SOC 2.
10. Engage a licensed CPA firm from the UK
What it is. A signed engagement with a firm licensed to perform the SOC 2 examination. In a Journal of Accountancy podcast, the AICPA's vice president for assurance and advisory innovation calls SOC 2 "an examination-level attestation engagement signed off on by a licensed CPA".
When it matters. Once scope and the period are agreed, and before the period opens.
What to do. Whether you engage a US firm directly or a UK practice, confirm in writing which licensed entity will sign the report. Our SOC 2 audit guide covers how the examination itself runs.
11. Prepare management's written assertion
What it is. A signed statement from management. The JofA guide says it confirms, to management's knowledge and belief, that the description is fairly stated and the controls were suitably designed and, for Type 2, operated effectively throughout the period.
When it matters. At the end of fieldwork, but the people signing need to understand it from the start.
What to do. Name the signatories when you agree item 2, and walk them through the description and controls before they sign.
What keeps SOC 2 compliance running after the first report?
SOC 2 compliance runs as a yearly cycle: back-to-back report periods, a refreshed description and scope, and controls that keep producing evidence. An ISO 27001 holder already runs an annual rhythm of internal audit and management review, so the habit carries over. What changes is that the customer receives a new report each year.
12. Run the annual cycle
What it is. A recurring calendar for the next period, the description refresh and the report's delivery to customers.
When it matters. From the day the first period ends. The same AICPA speaker says "it's also important that the services be done annually as things can change over time."
What to do. Fold the SOC 2 calendar into your ISMS calendar, so one internal audit and one management review serve both. Start each new period the day after the last one ends.
How to use this SOC 2 checklist
Work through the items in order. Items 1 and 2 decide how big the rest of the list is, so never start control work before they are answered. Items 6 to 9 are where most of the effort sits for an ISO 27001 holder, and item 9 cannot be compressed once the period starts.
If you do not hold ISO 27001, the order stays the same but the status column changes. Treat every "Covered" and "Adapt" item as new work, and expect items 6 to 8 to take the longest, because you are building the control set rather than mapping one. A readiness assessment is the natural starting point.
We recommend giving each item one owner, a target date and a link to its evidence. A checklist with owners is a plan; one without them is a reading list.
Frequently asked questions
The items are the same; the bar for item 9 is not. A Type 1 opinion covers whether the description is fairly presented and the controls are suitably designed, so period evidence is not yet needed. A Type 2 adds an opinion on whether the controls operated effectively, so every occurrence across the period must leave a record.
The summary table is built to work as a spreadsheet. Copy it into Excel or Google Sheets and add columns for owner, target date, status and evidence link.
It depends on scope and on how much evidence your controls already produce. Items 1 to 8 are bounded by your own team's capacity. Item 9 is bounded by the observation period you agreed, which no amount of effort shortens, so plan the rest of the list around it.
The AICPA publishes the criteria, the description criteria and a SOC 2 report review checklist for organisations reading a vendor's report. That checklist serves the customer reviewing your report. The list on this page is our own practical sequence for the firm being examined, written in our words.
Standard engine
SOC 2 reference directory.
Every control in this framework and the clause guides that sit above them, grouped by control domain. Open any entry for its control definition, implementation steps and the audit evidence it expects. Dimmed entries are planned.
AllAll Guides12 guides
GuideSOC 2 audit: who performs it, how long it takes and what happensGuideSOC 2 Type 1 vs Type 2: which report should you get first?GuideSOC 2 documentation: the documents, policies and controls matrix you needGuideSOC 2 compliance checklist: the phased checklist for UK firms (starting from ISO 27001)GuideSOC 2 system description: what to include, how to set scope, and a worked exampleGuideSOC 2 report: what's in it and how to read oneGuideSOC 2 certification: what you actually get and the route to your first reportGuideSOC 2 Trust Services Criteria: the five categories, the common criteria and the controls that meet themGuideSOC 2 cost in the UK: what 25–250 person firms payGuideISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?GuideSOC 2 bridge letter: what it covers, when customers ask, and a worked exampleGuideSOC 2 readiness assessment: how to find and close your gaps before the audit
SOC 2 Accelerator
Ready to accelerate your path to a clean Type II?
Work with a Trust Architect to scope your criteria, build evidence-generating controls, and get audit-ready — without stalling your roadmap.