How do I run a SOC 2 readiness assessment myself?
March 6, 20262 min readSOC 2 Basics for Founders
How Do I Assess Readiness Without a Consultant?
You can run your own readiness assessment using the AICPA's Trust Services Criteria as a checklist. Walk through each criterion, document what you already have in place, identify gaps, and create a remediation plan. This takes 1–2 weeks and costs nothing except your time.
Step-by-Step Self-Assessment
- Define your scope — List the systems that process customer data (cloud accounts, databases, applications, SaaS tools)
- Map existing controls — For each system, document what security controls exist today
- Check against criteria — Compare your controls to each Common Criteria point (CC1 through CC9)
- Identify gaps — Mark where you have no control, no documentation, or no evidence
- Prioritize remediation — Fix high-impact gaps first (access controls, change management, encryption)
- Document everything — Write down what you found and what you plan to fix
Key Areas to Evaluate
| Criteria | Key Questions | Common Gap |
|---|---|---|
| CC1 (Control environment) | Is there a security policy? Who owns security? | No written policy |
| CC2 (Communication) | Do employees know security expectations? | No security awareness program |
| CC3 (Risk assessment) | Have you identified and documented risks? | No risk register |
| CC5 (Control activities) | Are controls implemented for each risk? | Controls exist but are not documented |
| CC6 (Logical access) | Is access restricted and reviewed? | No formal access review process |
| CC7 (System operations) | Do you monitor for security events? | No centralized logging |
| CC8 (Change management) | Are changes approved before deployment? | Direct pushes to production |
| CC9 (Risk mitigation) | Do you assess vendor and third-party risk? | No vendor management process |
What to Do With the Results
Your gap report becomes your SOC 2 project plan. Rank each gap by effort (low/medium/high) and impact (blocks audit / creates risk / nice to have). Fix the audit-blocking items first.
Screenata automates this process by analyzing your codebase and infrastructure, producing a readiness report with specific remediation steps in days.