SOC 2 Type II readiness — 120-day sprint
Control-by-control checklist for CC-series criteria with owner, evidence type and the common ways auditors reject weak artefacts.
Control-by-control checklist for CC-series criteria with owner, evidence type and the common ways auditors reject weak artefacts.
Written by Sara Vanhoof and pressure-tested on live cybersecurity engagements before publication, this checklist is designed to move a programme forward the same week you open it.
Every section is annotated with the decision it should unblock, the owner it should sit with, and the evidence it should leave behind — so the artefact still holds up under audit twelve months later.
- Field-tested against real Stage 1 and Stage 2 audit findings
- Mapped to the controls and cadences the Cybersecurity faculty deploy in cohort work
- Editable, credit-line optional — use it inside your organisation without attribution
- Includes evidence pointers, owner fields and a first-90-days cadence
- Heads of GRC, CISOs, DPOs and internal audit leads
- Lead Implementers and Lead Auditors preparing for cert cycles
- Consulting teams standing up client programmes
Book a demo with the faculty who wrote this.
Walk through the checklist with a MAST practitioner — mapped against your controls, your evidence and your next audit window.
Statement of Applicability — ISO 27001:2022
Pre-mapped SoA covering all 93 Annex A controls with justification language, owner fields and evidence pointers ready for Stage 1.
How a regional bank rebuilt its ISMS in two cohorts
From a failed surveillance audit to a clean recertification in 11 months — what the security team changed in governance, evidence and training.