SOC 2 templates and checklists.

Policies, registers, checklists and letters, printed in full on the page, most with Word, PDF or Excel downloads. No email address, no form.

Policies

The information security policy template, with the policies it governsThe umbrella policy an auditor reads first: roles, oversight and an index of the other twelve.9 min read

The access control policy template, printed in fullAccounts, passwords, approvals, reviews and leavers, written so the records can prove it.7 min read

An acceptable use policy template your team can signThe rules for company accounts, laptops and data, with the acknowledgment each person signs.7 min read

The change management policy template for SOC 2How code and infrastructure reach production, and the record each change leaves behind.6 min read

The vendor management policy template, tiered by reachWhich vendors get assessed, how hard, how often, and what the contract has to say.6 min read

The data retention policy template, with classification and disposalFour data levels, how each is handled, how long each record is kept and how it is destroyed.8 min read

The encryption policy template, at rest and in transitWhat gets encrypted, with what, where the keys live and when they rotate.6 min read

The business continuity and disaster recovery plan templateRecovery targets, backups, the restore test that proves them, and what to do on the day.7 min read

The IT disaster recovery plan template, with a recovery runbook registerThe technical runbook beside the business continuity plan: what comes back, in what order, from which backup, and how you know it worked.8 min read

The incident response plan template SOC 2 auditors testWritten for a company that has never had an incident and will be tested on it anyway. Severity, roles, the clock, the review, the annual exercise.7 min read

The risk assessment policy template, with a scoring scaleHow risks are found, scored, treated and accepted, and what makes you look again.6 min read

The vulnerability management policy template, with fix deadlinesWhere findings come from, how fast each severity is fixed, and who can accept the rest.6 min read

The logging and monitoring policy template, with the alerts to setWhat gets logged, who cannot touch the logs, which events alert someone, and who looks.6 min read

The security awareness training policy template, with a training logWho is screened and trained, when, on what, and the log that proves it happened.8 min read

Registers and checklists

The user access review template, column by columnThe review record itself, header first, then eleven columns, then a worked row for the account that should not have been there.6 min read

The SOC 2 risk register, filled inSix real rows in a spreadsheet, and the reasoning that decides what each row says.6 min read

The vendor security assessment questionnaire template, and who gets oneTwenty four questions, grouped and numbered, with the rule that decides who receives them and the reason the rest of your vendor list should never see a form.6 min read

The vendor security questionnaire template you send to your vendors, with a scoring sheetThe outbound questionnaire: what to ask a vendor that holds your data, how to score the answers, and a worked answer set showing what good looks like.9 min read

The employee offboarding checklist, in the order it gets testedEighteen steps, an owner on every line, and the artifact each one has to produce. The whole thing is on this page rather than behind a form.6 min read

The access control matrix template: every system, role and approvalEvery system, the roles that reach it, the access each holds and who approved it.5 min read

A separation of duties matrix template for a team of fiveWho performs and who approves each sensitive activity, and what covers the gaps.6 min read

The IT asset inventory template: devices, systems and their dataEvery device with its protections, and every system with its owner and the data it holds.6 min read

The vendor register template: every vendor, its risk and last reviewEvery vendor that touches your data, how critical it is, and when you last checked it.6 min read

A vulnerability tracker template with fix-by datesEvery finding with severity, owner and a fix-by date, and the response times behind them.6 min read

The backup and restore test log template, with recovery targetsWhat is backed up, how often, and each restore test timed against your recovery targets.5 min read

The SOC 2 controls list, mapped to the Trust Services CriteriaSOC 2 publishes criteria, not controls. This is the control set a small software company can start from, row by row, with the evidence an auditor asks for.9 min read

The SOC 2 evidence request list, with a status trackerEvery request an auditor usually sends for a Security scoped SOC 2, numbered, with where the evidence comes from and what it must cover in a Type 1 and a Type 2.10 min read

The security incident log template, with a severity scale and review recordOne row per security event, opened at triage and never deleted. It is the record an auditor reads against CC7.3, CC7.4 and CC7.5, even in a quiet year.7 min read

The SOC 2 report review checklist for a vendor report you receivedFor the company on the receiving end. What to check in a vendor report, how to judge each exception, and what the report leaves for you to do.8 min read

People and governance records

A code of conduct template a small company can adoptThe standards everyone at the company agrees to, and how a concern gets raised and handled.8 min read

The code of conduct acknowledgment log, one row per personWho accepted the code of conduct, when, and the proof, at hire and every year.5 min read

Security roles and responsibilities, with a RACI matrixWho owns each security activity, written down once, so every task has a name next to it.6 min read

A security awareness program template a small team can runWho is trained, when, on what, and how completion is recorded and followed up.7 min read

The security training log, one row per completionEvery training completion with its date and proof, and a summary of who is still due.5 min read

A data classification standard template with four levelsFour classification levels, real examples of each, and the handling rules that follow.7 min read

Letters and answers

The SOC 2 management assertion, printed in fullSection 2 is one page, and your name goes on it. Both variants are below, with the clauses for vendors, exceptions and a signer who left.7 min read

The SOC 2 system description template, section by sectionSection 3 is management’s document, not the auditor’s. What belongs in each part, and the wording that gets sent back.8 min read

The SOC 2 bridge letter template, including the version where something changedThe letter management signs for the months after a report period ends, with the paragraphs for the case where something did change.6 min read

The management representation letter: SOC 2 wording to expect before you signThe CPA firm sends its own wording at the end of fieldwork. This is what it usually says, so management can check every line against its records before signing.6 min read

The SOC 2 in progress notice, with the email and the questionnaire answerThree pieces with one set of facts: the stage you are in, what is finished, when the report is expected, and what a customer can have today.6 min read

How to answer a security questionnaire with no SOC 2Twelve recurring questions, each with the answer that is true today and the answer that is true once a report exists, plus the four sentences that turn a delay into a misrepresentation.6 min read

Get audit-ready without a compliance team.

The SOC 2 readiness assessment is free, with no payment and no card. Answer it and 15 templates come filled in with your company's name, owners, systems and dates.

Take the free assessment