Contact us

SOC 2 Readiness Starter Kit

The core policies, readiness checklist and evidence tracker a small company needs before it talks to an auditor.

Buy the SOC 2 Starter Kit ($249)

A customer asked for your SOC 2 report. Start here.

Most companies start SOC 2 with nothing written down and a deal waiting on the report. The first months go to writing policies, deciding who owns which control, and figuring out what evidence an auditor will ask for.

This kit was written by a practitioner who has built SOC 2 programs from scratch and run them through Type 2 audits. It covers the Security category, which every SOC 2 report includes, and gives you a working set of policies, a plain readiness guide and the trackers to keep evidence flowing once the observation period starts.

What is inside

  • Start Here guide: what SOC 2 is, Type 1 versus Type 2, and the order to work in
  • Readiness Guide: scoping, control owners, evidence, choosing an auditor and planning the observation period
  • Ten policies mapped to the Security common criteria: information security, access control, change management, incident response, risk assessment, vendor management, business continuity and backup, data classification and retention, personnel security, and logging and monitoring
  • Readiness Checklist: grouped by criteria series, with the evidence an auditor will likely ask for
  • SOC 2 Trackers (Excel): control and evidence tracker with prefilled controls, policy register, vendor register, risk register and access review log

Every document comes as an editable Word file and as a PDF.

Who it is for

Founders, operations leads and first security or IT hires at SaaS and service companies with roughly 10 to 200 people.

What it is not

It is not an audit and it does not produce a SOC 2 report. Only an independent licensed CPA firm can issue one. Core-Infosec is not a CPA firm and does not promise any examination outcome.

$249, one-time purchase. Instant download after payment.

Buy the SOC 2 Starter Kit ($249)

FAQ

Does it cover Availability, Confidentiality, Processing Integrity or Privacy? It focuses on Security, which every report includes. The policies give you a base to extend if you add other categories.

Do I still need a compliance platform? Not to get started. Many small companies run readiness from documents and a spreadsheet. A platform can help later with evidence collection.

What format are the files? Word (.docx) and Excel (.xlsx) for editing, and PDF for reading.

What if it is not what I expected? Email us through the Contact Us page within 14 days and we will refund you.

Want someone to run readiness with you? Core-Infosec offers vCISO and compliance support.