Noru

Free tool

SOC 2 readiness check

Sixteen questions an auditor's first walkthrough would cover. Answer them and get a gap report you can share with your team, mapped to the criteria.

Governance and people

Have you decided which systems, services and trust services categories the report will cover?
Do you have approved, current security policies that every employee has acknowledged?
Is there a named owner for the security programme, with responsibilities written down?
Have you completed a documented risk assessment in the last twelve months, including fraud risk?
Do new hires get screened where the law allows, and does everyone complete security awareness training?

Access and data protection

Is multi-factor authentication enforced on every system in scope, including cloud consoles and source control?
Is access approved before it is granted, and removed within a defined time when someone leaves?
Do system owners review user access on a fixed cadence, and act on what the review finds?
Is customer data encrypted at rest and in transit, and are company laptops encrypted?

Monitoring and incidents

Do you log security events on in-scope systems, alert on the suspicious ones, and triage the alerts?
Do you scan for vulnerabilities and fix them within timeframes set in policy?
Do you have an incident response plan that was tested in the last twelve months?

Change management

Does every production change go through peer review and approval, enforced by the tooling rather than by habit?

Vendors and continuity

Do you keep a vendor inventory and review critical vendors' security, for example by reading their SOC 2 reports?
Are backups configured for every in-scope data store, and have you restore-tested them?

Audit planning

Have you chosen an auditor, and decided between a Type 1 and a Type 2 report?

Your gap report · 0 of 16 answered

Answer the questions above and the report builds here.

Your answers stay in this browser. The share link carries them after the #, which is never sent to our servers.

FAQ

Frequently asked questions

Talk to us

Is this a SOC 2 readiness assessment?

It is a self-check. A readiness assessment done by an auditor or consultant inspects your evidence; this asks whether the controls exist and points to what is missing. Use it to decide what to fix before paying for one.

How is the score calculated?

Yes counts two points, partly one and no zero, as a share of the questions you answered. The report only says you are ready to scope an audit when every question is answered and none is a no, because one missing control family can qualify an opinion.

Where do my answers go?

Nowhere. The check runs in your browser. The share link stores the answers after the # in the URL, a part browsers never send to the server.

Trust, settled.

A self-check is a snapshot. Noru keeps the answer current, control by control.

Book a demoMore free tools