1. Your setup
Extra trust criteria in scope (Security is always in):
2. Where do you stand on each control?
Yes = running and you could show evidence today. Partial = started or done unevenly. No = not done. N/A = does not apply (an auditor will ask why).
Answer the controls or load the example, then click Score my readiness.
Result
By area
| Area | Readiness | Gaps |
|---|
Your roadmap, in the order to do it
| # | Control | Weight | Days left | Done by | Evidence to collect |
|---|
The rules, and what they leave out
- Readiness = weighted share of in-scope controls done. Yes counts 1, partial counts 0.5, no counts 0; not applicable is left out.
- Weight (1 to 3) is how hard auditors tend to lean on a control. A weight-3 control that is not started is listed as a likely blocker.
- Order is weight times the missing share, divided by the days left, so cheap high-value fixes come first. Days are planning defaults for a small SaaS team; use the multiplier to match yours.
- Timeline adds the days left, divides by your weekly capacity, then adds the observation window for a Type II report.
- Not modelled: Processing Integrity, your auditor's own tests, the cost of tooling or the audit, and anything specific to your product or contracts. It is not a compliance platform and cannot issue or predict a report.
Common questions
What is SOC 2 readiness?
A readiness assessment compares the controls you run today with the ones an auditor will test for a SOC 2 report: policies, access reviews, change review, logging, backups, incident response and vendor management. The gaps are what you fix before the audit window starts.
How does this tool score readiness?
Each control has a weight from 1 to 3 for how hard auditors tend to lean on it. Yes counts 1, partial counts one half, no counts 0, and not applicable is left out. Readiness is the weighted share of controls done.
How long does SOC 2 take?
Two things set the length. First the time to close your gaps, which this tool estimates from your weekly capacity. Then, for a Type II report, an observation window of typically 3 to 12 months in which the controls must operate and leave evidence. Type I looks at one date and has no window.
What is the difference between SOC 2 Type I and Type II?
Type I says the controls were designed properly on one date. Type II says they also operated over a period. Many buyers ask for Type II, so the window is the longer part.
Is my answer data uploaded?
No. Your answers are used in this browser tab and nothing is sent anywhere. There is no account.
Does this replace a compliance platform or an auditor?
No. It is a planning aid built on a fixed list of common controls and rough effort figures. Only a licensed CPA firm can issue a SOC 2 report, and your auditor decides what they test.