{"head":{"title":"SOC 2 Checklist for Engineering Teams | OceanLab","description":"SOC 2 Trust Services Criteria turned into engineering tasks: access control, logging, change management and vendors. Track progress and export.","canonical":"https://oceanlab.in/tools/soc-2-checklist"},"tool":{"slug":"soc-2-checklist","path":"/tools/soc-2-checklist","name":"SOC 2 checklist","h1":"SOC 2 readiness checklist","lede":"Turn the SOC 2 criteria into engineering tasks, pick the categories in scope, and track what is still open.","category":"compliance","categoryTitle":"Compliance checklists","method":["Security (the Common Criteria, CC1 to CC9) is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are added when you pick them.","Each task is mapped to the Trust Services Criteria series it supports. The wording is OceanLab's paraphrase: the AICPA criteria text sits behind a sign-up form and was not reproduced.","Your ticks are saved in this browser only. Export them as Markdown or print the page."],"sources":[{"label":"AICPA 2017 Trust Services Criteria (revised points of focus, 2022)","url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","checkedAt":"2026-10-23"}],"faq":[{"question":"Is Security always in scope?","answer":"Yes. The Common Criteria (CC1 to CC9) are in every SOC 2 report. The other four categories are optional."},{"question":"What is the difference between Type I and Type II?","answer":"Type I reports on how controls are designed at a point in time. Type II also tests that they operated over a period, usually several months."},{"question":"Are these the official criteria?","answer":"Tasks are mapped to the criteria series IDs, with wording paraphrased by OceanLab. Use the AICPA criteria and your auditor for the exact text."},{"question":"Is this audit or legal advice?","answer":"No. It is guidance for engineering teams. Your auditor decides the scope and what evidence is enough."}],"notice":{"title":"Guidance, not legal advice.","text":"Your auditor decides the scope and what evidence is enough."},"updatedAt":"2026-10-25"},"related":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Work through every Security Rule safeguard with its citation and what it means for your code, then export your progress."},{"href":"/tools/eu-ai-act-risk-checker","label":"EU AI Act risk checker","detail":"Answer a few questions about your AI system to see its likely risk tier, what you would have to do, and from when."},{"href":"/tools/software-maintenance-cost","label":"Software maintenance cost","detail":"See what a product costs to keep running each year after launch, and which line grows fastest."}],"studies":[{"meta":{"slug":"migdalor","industry":"regtech","projectType":"Audit readiness tracker","country":"il","tags":["saas"],"compliances":["SOC 2","ISO/IEC 27001:2022","Israeli Protection of Privacy Law (Amendment 13)","Israeli Data Security Regulations","GDPR"],"cover":{"src":"/case-studies/migdalor/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups","description":"Designed and built a clickable audit readiness tracker for startups preparing for SOC 2 and ISO/IEC 27001: one control library mapped to both frameworks, automated tests against cloud, identity, code, HR and device systems, and an inbox that chases the evidence nobody can automate.","category":"RegTech / Audit Readiness","client":"Yarkon Stack"}}},{"meta":{"slug":"kleidi","industry":"internal","projectType":"SaaS admin dashboard","country":"gr","tags":["saas","enterprise"],"compliances":["GDPR","SOC 2","ISO/IEC 27001"],"cover":{"src":"/case-studies/kleidi/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail","description":"Designed and built a clickable internal admin console for an Athens SaaS company that sells housekeeping software to EU hotels: find any tenant and see everything about it on one page, enter a customer's workspace only with their consent, work GDPR data requests on the clock, and give staff elevated rights only for a limited window with someone else's approval.","category":"Internal Tools / SaaS Admin Console","client":"Myrtaki Software"}}},{"meta":{"slug":"umurinzi","industry":"security","projectType":"Security posture dashboard","country":"rw","tags":["enterprise","healthcare"],"compliances":["Rwanda Law No. 058/2021 (personal data)","ISO/IEC 27001:2022","SOC 2","CIS Benchmarks (AWS, Google Cloud)"],"cover":{"src":"/case-studies/umurinzi/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Umurinzi - Cloud Security Posture and Control Mapping Dashboard","description":"Designed and built a clickable cloud security posture dashboard for a Kigali healthtech on AWS and Google Cloud: one findings queue checked against the CIS Benchmarks, identity risks and internet exposure in one view, every check mapped to ISO 27001 and SOC 2 controls, and a residency check for Rwandan patient data.","category":"Cybersecurity / Cloud Security Posture","client":"Isimbi Health Ltd"}}},{"meta":{"slug":"pylon","industry":"insurance","projectType":"Insurance operations console","featured":true,"country":"us","tags":["insurtech","ai","saas","enterprise"],"compliances":["SOC 2 Type II","HIPAA-aligned","GDPR","ISO 27001"],"cover":{"src":"/pylon-1.png","width":1440,"height":1207}},"text":{"en":{"title":"Building Pylon - AI-Native Insurance Operations from Prototype to Production","description":"Replaced fragmented policy spreadsheets and disconnected claims tools with a unified AI-driven workspace, designed and shipped in 8 weeks via clickable AI prototype.","category":"InsurTech","client":"Pylon"}}},{"meta":{"slug":"shadoof","industry":"devtools","projectType":"Feature flags service","country":"eg","tags":["enterprise"],"compliances":["SOC 2","Egypt PDPL (Law No. 151 of 2020)"],"cover":{"src":"/case-studies/shadoof/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams","description":"Designed and built a clickable feature flag console for the engineering teams of a Cairo online marketplace: targeting rules and sticky percentage rollouts per environment, change requests with a second approver for Production, kill switches for incidents and a full change history for every flag.","category":"Developer Tools / Feature Flags","client":"Khan Sukkar"}}}],"more":[{"href":"/case-studies/industry/regtech","label":"RegTech & compliance case studies","detail":"Every OceanLab product build in RegTech & compliance."},{"href":"/case-studies/industry/security","label":"Cybersecurity case studies","detail":"Every OceanLab product build in Cybersecurity."},{"href":"/case-studies","label":"All case studies","detail":"Every OceanLab product build."},{"href":"/ai-automation","label":"AI automation","detail":"AI built into real business workflows, with people in charge."}],"today":"2026-10-25"}