Is your organization ready for SOC 2? Let's find out.
The InfoPathways SOC 2 Type II Readiness Assessment helps you uncover gaps in your current control environment before they become obstacles during an audit. Evaluate your organization's readiness, identify areas that need attention, and get a clearer understanding of the steps needed to strengthen your SOC 2 program.
Section 1 of 10
SOC 2 Trust Services Readiness Assessment
This assessment evaluates your organization's readiness for SOC 2 Type II certification based on the five trust service criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
You will be asked about your control environment, risk management, monitoring, access controls, and compliance practices.
Estimated time: 10-15 minutes
Control Environment (CC1)
1. Does your leadership regularly communicate and demonstrate a commitment to ethical business practices and integrity throughout the organization?
2. Does your board of directors and senior management actively oversee the design and effectiveness of internal controls?
3. Is your organizational structure, lines of authority, and assignment of responsibilities clearly defined and documented?
4. Does your organization invest in hiring, training, and developing personnel with the skills and knowledge needed for their roles?
5. Does your organization hold individuals accountable for their responsibilities in maintaining effective internal controls?
Communication & Information (CC2)
6. Are internal communication channels established so employees understand their roles in maintaining control objectives?
7. Are communication channels with customers, vendors, and external stakeholders defined and documented?
8. Do your information systems provide quality, timely, and accurate information to support decision-making and control activities?
Risk Assessment (CC3)
9. Has your organization documented its business objectives and identified what would prevent them from being achieved?
10. Does your organization conduct periodic risk assessments to identify threats to achieving your objectives?
11. Does your organization specifically assess and consider fraud risk in your risk identification and response planning?
12. When significant changes occur (system upgrades, staffing changes, process changes), does your organization assess their impact on internal controls?
Monitoring Activities (CC4)
13. Does your organization conduct ongoing evaluations of controls, separate audits, or both to verify they are working effectively?
14. When control deficiencies are identified, does your organization document them and communicate them promptly to the appropriate parties for remediation?
Control Activities (CC5)
15. Has your organization designed and implemented control activities to mitigate identified risks to acceptable levels?
16. Does your organization have general IT controls in place to support the security and integrity of your systems and data?
17. Are control activities deployed through documented policies, procedures, and operating guidelines across the organization?
Logical & Physical Access Controls (CC6)
18. Do you have logical access controls (firewalls, authentication, encryption) to protect your systems and data from unauthorized access?
19. Before granting new user access to systems, does your organization verify authorization and ensure appropriate segregation of duties?
20. When employees terminate or change roles, does your organization promptly remove or modify their system access?
21. Does your organization restrict physical access to facilities and equipment that contain critical systems and data?
22. Does your organization protect data during transmission (encryption in transit) and securely dispose of data when it is no longer needed?
System Operations (CC7)
23. Does your organization monitor your systems for vulnerabilities and apply security patches in a timely manner?
24. Does your organization have defined processes to detect, investigate, respond to, and resolve security incidents?
25. Does your organization have tested recovery plans and procedures in place for system failures and data loss scenarios?
Change Management (CC8)
26. Are changes to infrastructure, software, and business procedures formally authorized, designed, tested, and approved before deployment?
27. Does your organization have risk mitigation strategies to address potential business disruption and continuity risks?
28. Does your organization assess, monitor, and manage risks associated with vendors and business partners throughout your relationships?
Additional Trust Service Criteria (A1, C1, PI1, P1-P8)
29. Does your organization monitor system capacity and proactively manage resources to ensure systems meet availability commitments?
30. Are environmental protections, data backups, and recovery infrastructure in place to protect against data loss and system failures?
31. Are your disaster recovery and business continuity plans regularly tested and updated to ensure they are effective?
32. Is confidential information identified and protected throughout its entire lifecycle (collection, use, storage, and disposal)?
33. When confidential information is no longer needed, does your organization securely destroy or dispose of it to prevent unauthorized access?
34. Does your organization ensure that system processing is complete, valid, accurate, timely, and authorized before processing transactions?
35. When collecting personal information, does your organization provide a privacy notice and obtain customer consent where required by law?
36. Does your organization limit personal information collection to only what is necessary for identified purposes?
37. Does your organization retain and securely dispose of personal information according to documented retention policies?
Almost Done!
Please enter your information below to receive your results via email.
Assessment Complete
Your detailed SOC 2 Type II readiness results and remediation recommendations have been sent to . Check your inbox for your full assessment report.