SOC 2 Readiness Assessment: Score Your Trust Services Criteria Gaps

Self-assess your readiness against the SOC 2 Trust Services Criteria privately, with no signup and no server.

SOC 2 audits are graded against the AICPA's Trust Services Criteria, a specific published structure of control categories, not a vibe check — and this quiz walks through 26 yes/no questions organized under exactly those categories, scoring each one independently so a strong security posture doesn't quietly paper over a weak privacy program hiding in the same overall percentage.

What a SOC 2 readiness assessment is

A readiness assessment is a gap check you run before the SOC 2 audit begins. It compares the controls you actually operate against the AICPA Trust Services Criteria and lists what is missing, so the audit window does not open on a control nobody has built yet.

Some teams run it internally with a checklist like this one; others pay a CPA firm or security consultant to review documents and walk through controls. Either way the output is a remediation list, not an attestation you can send to customers, because only a licensed CPA firm can issue the SOC 2 report itself.

How to run your SOC 2 self-assessment

  1. Decide which categories your customers need attested: Security always, plus any of Availability, Processing Integrity, Confidentiality or Privacy.
  2. Choose your target report, Type 1 or Type 2; the questions are identical, but for Type 2 every Yes has to hold up across an observation window.
  3. Work through the 26 questions (8 Security, 5 Availability, 4 Processing Integrity, 4 Confidentiality, 5 Privacy), leaving anything you cannot vouch for as Not assessed.
  4. Copy every No into a gap list with an owner and a target date, then come back and flip it to Yes once the control is really in place.
  5. When your in-scope categories reach Audit-ready, print the readiness report and use it to brief the CPA firm you engage for the audit.

Five categories, not one blended score

Security is the only category required in every SOC 2 report — it maps to the Common Criteria, CC1 through CC9, and covers eight questions here on things like multi-factor authentication for privileged access, a documented incident-response plan, and recurring access reviews. Availability, Processing Integrity, Confidentiality, and Privacy are additional categories an organization can choose to include depending on what its customers actually need attested to, and each gets its own separate score rather than being folded into one number.

That separation matters because a company can be genuinely strong on Security while having no privacy program at all — a single blended percentage would hide exactly that gap, which is the failure mode keeping the categories apart is meant to prevent.

The nine Common Criteria (CC1–CC9)

The eight Security questions here touch CC6 (MFA, access reviews, encryption), CC7 (vulnerability scanning, incident response), CC8 (change management), CC9 (vendor risk) and CC1–CC2 (security training). Risk assessment, monitoring and the broader control-activity criteria have no dedicated question, which is one reason a high score is not a full audit read.

SOC 2 Type 1 vs Type 2

A Type 1 report gives an auditor's opinion on whether your controls are suitably designed at a single point in time. A Type 2 report also tests whether those controls operated effectively across an observation period, commonly somewhere between three and twelve months.

Many first-time companies get a Type 1 to unblock early deals and start the Type 2 window straight afterwards. This quiz cannot tell the two apart: a Yes records that a control exists today, while a Type 2 auditor samples evidence from across the whole period.

A skipped question counts as unassessed, never as a pass or fail

Every question defaults to no answer at all until you actually click yes or no — there's no hidden assumption that an unanswered question means 'probably fine' or 'probably not in place.' The scoring only counts questions you've actually answered, so leaving half the Privacy category blank doesn't quietly drag or inflate that category's percentage based on a guess.

This is a meaningful difference from a checklist that defaults everything to unchecked-equals-no: a genuinely unassessed control is not the same thing as a confirmed absent one, and conflating them would misrepresent how close you actually are to readiness.

What the readiness band is telling you

Each category's score is the percentage of its answered questions marked Yes. The overall score averages only the categories where you have answered at least one question, then maps to a status: Audit-ready at 85% or above, Gaps to close from 60% up to 85%, and Not ready below 60%.

A high band on this quiz does not mean an auditor will issue a clean report — it means the specific 26 controls this quiz asks about, which are a representative sample of the published Trust Services Criteria rather than the complete literal text of the AICPA standard, are largely in place as of the moment you answered.

Answers live in the link, not on a server

Scoring runs inside the page, with no account, database or network call behind it. As you click, the tool writes your answers into the part of the address after the # sign, so refreshing the tab or reopening a bookmark brings the same assessment back.

Browsers never send that fragment to the web server when a page loads, so the link itself is the only stored copy, and anyone you share it with will see your answers. Reset all answers clears the set, and the Print / Save as PDF button on the readiness report gives you a copy with each category's score and its not-assessed count.

SOC 2 self-assessment vs a paid readiness assessment

This self-check costs nothing and takes minutes, but it covers 26 representative controls and relies on your own judgement for every Yes. A paid readiness assessment puts an outside reviewer on the same questions: they read your policies, walk through controls and sample evidence.

Compliance-platform vendors such as Vanta and Secureframe put a consultant-led readiness assessment at roughly $10,000 to $17,000 depending on scope, billed separately from the audit itself. Running a free self-check first lets you close the obvious gaps before paying anyone by the hour.

Where a real audit diverges from this quiz

Questions people ask about SOC 2 Audit Readiness Score

Does a high score mean I'm ready to pass a SOC 2 audit?
Not on its own. A high band means the 26 representative controls this quiz asks about are largely in place as you answered them, but an actual SOC 2 Type II report requires evidence those controls operated effectively over an observation period, which this quiz has no way to verify.
What happens if I skip a question instead of answering it?
It's counted as not-assessed and excluded from that category's percentage entirely — it is never treated as an automatic yes or an automatic no. Leaving several questions blank in a category will shrink the pool that category's score is calculated from, rather than silently dragging the score down.
Will my answers still be here if I refresh the page?
Yes. Every answer is encoded into the page address after the # sign, so a refresh or a bookmarked link restores the same assessment. That fragment is never sent to a server; clicking Reset all answers, or opening the tool without the fragment, starts a fresh assessment.
Do I need all five categories for my SOC 2 report?
Security is required in every SOC 2 report; Availability, Processing Integrity, Confidentiality, and Privacy are optional categories you and your auditor scope in based on what your customers actually need attested to. Which categories apply to you is a scoping conversation with your auditor, not something this quiz decides.
How much does a SOC 2 readiness assessment cost?
This self-assessment is free and needs no account. A readiness assessment from a consultant or CPA firm is priced by scope; compliance vendors such as Vanta and Secureframe cite roughly $10,000 to $17,000, and the audit that produces the actual SOC 2 report is billed on top.
What's the difference between a SOC 2 self-assessment and a readiness assessment?
A self-assessment is your own team answering control questions, like the 26 here, with no outside review. A formal readiness assessment is usually run by a consultant or audit firm who inspects documents and evidence. Both are preparation; neither one produces a SOC 2 report.
What's the difference between SOC 2 Type 1 and Type 2?
Type 1 evaluates whether controls are designed properly at one point in time. Type 2 tests whether they actually operated effectively over an observation period, commonly three to twelve months, so it takes longer to earn and generally carries more weight with larger customers.

Related tools on BrakeTools

Content reviewed 2026-09-27.