Agent-led compliance · Open source · SOC 2 checklist
SOC 2 Compliance Checklist 2026
The complete checklist of SOC 2 requirements for Type I and Type II certification. Use this guide to prepare for your audit.
Trusted by 600+ companies from startups to enterprise
5
Trust Service Criteria
60+
Common Controls
Days
To Audit-Ready with Comp AI
Checklist
SOC 2 Trust Service Criteria
Security is required. Choose additional criteria based on your business needs.
Security (Required)Required
Protection against unauthorized access
- Access control policies and procedures
- Multi-factor authentication (MFA)
- Firewall and network security
- Encryption at rest and in transit
- Vulnerability management program
- Security awareness training
- Incident response procedures
- Vendor risk management
Availability
System availability for operation and use
- Uptime monitoring and SLAs
- Disaster recovery plan
- Business continuity procedures
- Backup and restoration testing
- Capacity planning
- Incident communication plan
Processing Integrity
System processing is complete and accurate
- Data validation controls
- Error handling procedures
- Change management process
- Quality assurance testing
- Processing monitoring
Confidentiality
Information designated as confidential is protected
- Data classification policy
- Confidential data encryption
- Access restrictions
- Data retention and disposal
- NDA management
Privacy
Personal information is collected, used, and retained properly
- Privacy policy and notice
- Consent management
- Data subject rights procedures
- Data minimization practices
- Third-party data sharing controls
Timeline
SOC 2 Implementation Timeline
Typical timeline for first-time SOC 2 certification
1Phase 1: Preparation(1-2 weeks)
- Define scope and trust service criteria
- Identify key stakeholders and assign roles
- Perform gap assessment
- Select audit firm
- Set timeline and milestones
2Phase 2: Policy Development(2-4 weeks)
- Create information security policy
- Develop access control policy
- Document change management procedures
- Write incident response plan
- Establish vendor management policy
3Phase 3: Control Implementation(2-4 weeks)
- Implement technical controls
- Configure monitoring and logging
- Set up access management
- Deploy security tools
- Train employees
4Phase 4: Evidence Collection(1-2 weeks)
- Gather policy documentation
- Collect system configurations
- Document access reviews
- Compile training records
- Prepare audit evidence package
5Phase 5: Audit(2-4 weeks)
- Auditor kickoff meeting
- Control testing and walkthroughs
- Address auditor questions
- Remediate any findings
- Receive SOC 2 report
Report types
SOC 2 Type I vs Type II
Understanding the difference between Type I and Type II reports
Type I
- Point-in-time assessment
- Tests control design only
- Faster to achieve (days with Comp AI)
- Good for first-time certification
Type II
- Period-of-time assessment (3-12 months)
- Tests control design AND effectiveness
- Required by most enterprise customers
- More comprehensive assurance
Compliance that actually improves your security
Most platforms give you a checklist. We give you a security posture you can prove - continuously, automatically, and in the open.
- Evidence that's never stale
- Most platforms rely on manual screenshots and spreadsheets. By the time you collect evidence, something has already regressed. We pull evidence continuously from 500+ integrations - every config, every screenshot, every log - so your compliance posture reflects reality, not last quarter.
- Integration platform on GitHub
- Policies written for your business, not a template
- Other platforms hand you generic policy documents and call it done. We generate every policy from the context you provide during onboarding - your stack, your processes, your risk tolerance. No two customers get the same boilerplate.
- A device agent that never sleeps
- A checklist doesn't stop a misconfigured laptop at 2am. Our open-source device agent runs 24/7 on every employee machine - checking disk encryption, firewall status, screen lock, password length, and antivirus. Failures are flagged instantly, not discovered during the next audit cycle.
- Device agent on GitHub
- Automated tests you can write yourself
- Say "show me that SSL is active on my domain" and it generates an automated test that runs daily. Or give it browser instructions - "go to our GitHub repo, click settings, verify branch protection rules" - and AI opens a browser, verifies the control, and screenshots the result. Every evidence piece is auditable and logged.
- Trust portals that reflect reality
- Most trust centers are static marketing pages. Ours is live-monitored - only published policies appear, and only verified controls are shown. The moment a policy is marked as draft or a control fails, it's removed automatically. What your customers see is what you actually have.
- View ours
- Open source and verifiable
- Most compliance platforms are black boxes - you trust them because you have to. We're fully open source. Every agent, every integration, every check is auditable on GitHub. You don't take our word for it, you verify it.
- View the full source on GitHub
01.
02.
03.
04.
05.
06.
Don't let compliance slow down your pipeline
AI agents automate the busywork - evidence collection, monitoring, audit prep - so your team can focus on closing deals.