SOC 2 Readiness Self-Assessment

Use the score to organize questions

This tool summarizes your own assessment of eight control domains. It does not inspect your systems, validate evidence, cover every SOC 2 criterion, or predict an auditor's opinion. A high score should prompt an evidence review, not a claim that your organization has passed an assessment.

The tool assigns zero, one, or two points to each domain. The displayed percentage is the share of the sixteen possible self-reported points. All domains are weighted equally in this simple model, even though their risk and work may differ in your environment.

Choose a score you can explain

Score	Working interpretation
0	The control process is missing or you cannot identify how it operates
1	Some implementation exists, but scope, consistency or evidence remains incomplete
2	You believe the process is implemented and can identify evidence for review

If you are uncertain, use the lower score and record the question to investigate. Do not average away a critical gap simply because other domains are stronger.

Turn the result into implementation work

For each low-scoring domain, identify the affected system, accountable owner, next action, and record needed to verify completion. For access controls, that might be an approved account inventory and completed review. For recovery, it might be a scoped restore exercise with documented results.

Review the backlog with the people who approve changes and with the assessor responsible for any formal examination. A readiness project and an audit observation period are different parts of the process.

Your selections are calculated in this page and are not submitted as a lead. To request help, use Contact separately. Download the readiness scorecard to keep your notes, or read about SOC 2 implementation.