SOC 2 Checklist for Engineering Teams

Progress

0 of 19

0% done. Ticks are saved in this browser only.

Categories in scope (Security is always included)

Availability

Confidentiality

Processing integrity

Privacy

Required done: 0 of 16
Access control: 0 of 5
Logging and monitoring: 0 of 4
Change management: 0 of 3
Risk and vendors: 0 of 2
Policies and people: 0 of 2
Availability: 0 of 2
Confidentiality: 0 of 1

Access control

SSO + MFA for all production and admin accessTSC CC6 · Security, always in scopeOne identity provider; MFA enforced; no local accounts on cloud consoles.
Least-privilege rolesTSC CC6 · Security, always in scopeIAM roles per job; no shared root keys; production DB access is time-boxed and logged.
Quarterly access reviewsTSC CC6 · Security, always in scopeExport who has access to what, have owners sign off, remove the rest. Keep the export as evidence.
Same-day offboardingTSC CC6 · Security, always in scopeA checklist or automation that revokes every account when someone leaves.
Encryption in transit and at restTSC CC6, C1 · Security, always in scopeTLS on every connection; encrypted databases, buckets and backups.

Logging and monitoring

Central, retained logsTSC CC7 · Security, always in scopeApp, infra and auth logs in one place with a set retention period and restricted delete rights.
Security alerting with an ownerTSC CC7, CC4 · Security, always in scopeAlerts on suspicious logins, permission changes and anomalies route to an on-call person.
Vulnerability scanningTSC CC7 · Security, always in scopeDependency, container and cloud-config scanning in CI, with fix-by dates per severity.
Incident response plan, testedTSC CC7 · Security, always in scopeWritten runbook, a tabletop exercise each year, and a record of every incident.

Change management

Every production change goes through a reviewed PRTSC CC8 · Security, always in scopeBranch protection: required review, required checks, no direct pushes to main.
Automated, logged deploysTSC CC8 · Security, always in scopeDeploys only through CI/CD, so every release links to a commit and an approver.
Infrastructure as codeTSC CC8 · Security, always in scopeCloud resources defined in code and changed through the same PR flow.

Risk and vendors

Risk assessment and registerTSC CC3, CC9 · Security, always in scopeA yearly risk assessment with owners and treatments.
Vendor reviewTSC CC9 · Security, always in scopeList of vendors that touch customer data, with their SOC 2 reports or questionnaires on file.

Policies and people

Core policies approvedTSC CC1, CC2, CC5 · Security, always in scopeSecurity, access, change, incident, vendor and data retention policies, signed off and shared.
Security training and background checksTSC CC1 · Security, always in scopeTraining at hire and yearly; acknowledgements kept as evidence.

Availability

Backups and restore testsTSC A1 · Optional categoryAutomated backups; restore tested on a schedule with the result recorded.
Uptime and capacity monitoringTSC A1 · Optional categoryUptime checks, capacity alerts and a status page or customer notice path.

Confidentiality

Data classification and disposalTSC C1 · Optional categoryLabel confidential data; delete it on schedule and when customers leave.

Ask OceanLab to help close the gaps

Opens an email to OceanLab with this result and a link to your inputs. Nothing is sent until you press send, and there is no sign-up.

Prefer a form? Use the contact page.

Method

How this is calculated

Security (the Common Criteria, CC1 to CC9) is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are added when you pick them.

Each task is mapped to the Trust Services Criteria series it supports. The wording is OceanLab's paraphrase: the AICPA criteria text sits behind a sign-up form and was not reproduced.

Your ticks are saved in this browser only. Export them as Markdown or print the page.

Sources

AICPA 2017 Trust Services Criteria (revised points of focus, 2022) · checked 2026-10-23

FAQ

Questions about this tool

Is Security always in scope?

Yes. The Common Criteria (CC1 to CC9) are in every SOC 2 report. The other four categories are optional.

What is the difference between Type I and Type II?

Type I reports on how controls are designed at a point in time. Type II also tests that they operated over a period, usually several months.

Are these the official criteria?

Tasks are mapped to the criteria series IDs, with wording paraphrased by OceanLab. Use the AICPA criteria and your auditor for the exact text.

Is this audit or legal advice?

No. It is guidance for engineering teams. Your auditor decides the scope and what evidence is enough.

Related tools

Other free tools

HIPAA checklistWork through every Security Rule safeguard with its citation and what it means for your code, then export your progress.EU AI Act risk checkerAnswer a few questions about your AI system to see its likely risk tier, what you would have to do, and from when.Software maintenance costSee what a product costs to keep running each year after launch, and which line grows fastest.All toolsEvery OceanLab calculator and checklist, by category.

Product builds

OceanLab product builds like this

Products OceanLab designed and built. Each case study covers the screens, the scope and the rules it was built for.

RegTech & compliance·🇮🇱Israel

Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups

Designed and built a clickable audit readiness tracker for startups preparing for SOC 2 and ISO/IEC 27001: one control library mapped to both frameworks, automated tests against cloud, identity, code, HR and device systems, and an inbox that chases the evidence nobody can automate.

SaaS

Internal tools & ops·🇬🇷Greece

Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail

Designed and built a clickable internal admin console for an Athens SaaS company that sells housekeeping software to EU hotels: find any tenant and see everything about it on one page, enter a customer's workspace only with their consent, work GDPR data requests on the clock, and give staff elevated rights only for a limited window with someone else's approval.

SaaSEnterprise

Cybersecurity·🇷🇼Rwanda

Umurinzi - Cloud Security Posture and Control Mapping Dashboard

Designed and built a clickable cloud security posture dashboard for a Kigali healthtech on AWS and Google Cloud: one findings queue checked against the CIS Benchmarks, identity risks and internet exposure in one view, every check mapped to ISO 27001 and SOC 2 controls, and a residency check for Rwandan patient data.

EnterpriseHealthcare

Insurance·🇺🇸United States

Building Pylon - AI-Native Insurance Operations from Prototype to Production

Replaced fragmented policy spreadsheets and disconnected claims tools with a unified AI-driven workspace, designed and shipped in 8 weeks via clickable AI prototype.

InsurTechAISaaSEnterprise

Developer tools & APIs·🇪🇬Egypt

Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams

Designed and built a clickable feature flag console for the engineering teams of a Cairo online marketplace: targeting rules and sticky percentage rollouts per environment, change requests with a second approver for Production, kill switches for incidents and a full change history for every flag.

Enterprise

SOC 2 readiness checklist

Ask OceanLab to help close the gaps

How this is calculated

Sources

Questions about this tool

Other free tools

OceanLab product builds like this

Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups

Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail

Umurinzi - Cloud Security Posture and Control Mapping Dashboard

Building Pylon - AI-Native Insurance Operations from Prototype to Production

Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams

Your Next Mission-Critical
System Starts Here

Ask OceanLab to help close the gaps

How this is calculated

Sources

Questions about this tool

Other free tools

OceanLab product builds like this

Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups

Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail

Umurinzi - Cloud Security Posture and Control Mapping Dashboard

Building Pylon - AI-Native Insurance Operations from Prototype to Production

Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams

Your Next Mission-CriticalSystem Starts Here

Your Next Mission-Critical
System Starts Here