# Soc2 readiness assessment
> Source: https://legalcode.md/skills/legalcode-soc2-readiness-assessment | [HTML version](https://legalcode.md/skills/legalcode-soc2-readiness-assessment)

Assess SOC 2 Type I and Type II readiness across all five AICPA Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy).

Assess SOC 2 Type I and Type II readiness across all five AICPA Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Use when a SaaS company, cloud service provider, managed service provider, or other service organization needs to determine readiness for a SOC 2 audit, identify control gaps, build a remediation roadmap, or understand how SOC 2 maps to ISO 27001, NIST CSF, HIPAA, or PCI DSS. Covers all Common Criteria (CC1–CC9), optional TSC criteria (A, PI, C, P series), evidence collection requirements per control, management assertion obligations under AT-C Section 205, subservice organization carve-out vs. inclusive method, and Complementary User Entity Controls (CUECs). Produces a COMPLIANT/PARTIAL/NON-COMPLIANT/CRITICAL DEFICIENCY classification per control domain, prioritized remediation roadmap, cross-framework gap analysis, and auditor-ready evidence inventory. Also use when reviewing a vendor's SOC 2 report as a user entity, evaluating SOC 2 scope adequacy, or assessing bridge letter sufficiency.

This skill assesses a service organization's readiness for a SOC 2 Type I or Type II examination under the AICPA 2017 Trust Service Criteria (TSC), with 2022 points of focus updates. **Covers:** - Readiness assessment across all five Trust Service Criteria categories - Gap identification against each Common Criteria (CC1–CC9) and optional TSC criteria - Evidence sufficiency review (what exists vs. what auditors will require) - Remediation roadmap with prioritization by risk and audit timeline - Framework crosswalk: SOC 2 ↔ ISO 27001, NIST CSF, HIPAA, PCI DSS - Subservice organization scope decisions (carve-out vs. inclusive method) - System description completeness review (management assertion readiness) - User entity perspective: reviewing a vendor's SOC 2 report for adequacy - Bridge letter assessment for expired or gap-period reports **Does not:** - Issue a SOC 2 opinion or formal attestation (only licensed CPA firms may do this) - Provide legal advice or replace qualified counsel - Substitute for a qualified auditor's judgment on control design or operating effectiveness - Cover SOC 1 (financial reporting controls) or SOC 3 (public-use summary reports) SOC 2 is a US-origin standard governed by the AICPA (American Institute of Certified Public Accountants) under AT-C Section 205 (Examination Engagements) ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*