SOC 2 Compliance Checklist 2026 (Interactive, 12 Domains)

This is an interactive, use-it-now SOC 2 compliance checklist covering all 12 control domains. Tick items as you go the progress bar tracks your completion, and each domain tells you exactly what evidence auditors look for and the single most common gap they find. Nothing is saved or sent anywhere; it runs entirely in your browser.

The checklist gives you the shape of SOC 2 readiness the key checkpoints in each domain. It is not the full control set; a complete SOC 2 programme spans 200+ controls. When you want a scored, prioritised picture of where you actually stand across every control, the free SOC 2 Readiness Assessment does that in 10 minutes and gives you a weighted score, a critical gap list, and a board-ready summary. Use this checklist to understand the terrain; use the tool to get your number.

A note on scope: the first nine domains map to the SOC 2 Common Criteria, which every SOC 2 engagement includes. The last three Confidentiality, Privacy, and Availability are additional Trust Services Criteria that apply only if you select them for your audit. Tick those only if they are in your scope.

What Your Completion Score Actually Tells You

Your percentage on this checklist is a rough self-read, not an audit result. As a rule of thumb: below 50% means you have substantial control-building ahead and should not engage an auditor yet; 50–80% means the foundations exist but specific domains need work; above 80% means you are close, with the remaining gaps usually being evidence and documentation rather than missing controls.

But a checklist can only tell you whether a control exists it can't weight the domains by how heavily auditors scrutinise them, score partial implementations, or tell you which gaps to fix first. That is what the free SOC 2 Readiness Assessment does: it scores all 200+ controls with weighting applied to the highest-risk domains, produces a prioritised critical-gap list, and gives you an executive summary you can take to your board. The checklist shows you the terrain; the tool gives you the map.

Related reading:

• SOC 2 Readiness Assessment: Free Tool, Instant Score
• What Is SOC 2 Compliance? A Plain-English Guide for SaaS Companies in 2026
• SOC 2 Type 1 vs Type 2: Which One Do You Actually Need?
• SOC 2 Gap Analysis: What It Covers and How to Prepare
• SOC 2 vs ISO 27001: Differences and Which You Need

Frequently Asked Questions

Is this SOC 2 compliance checklist free to use?

Yes completely free, no sign-up, and nothing is saved or transmitted. It runs entirely in your browser. For a scored version across all 200+ controls, the free SOC 2 Readiness Assessment is also free and produces a weighted score in about 10 minutes.

Does this checklist cover every SOC 2 control?

No. It covers the key checkpoints in each of the 12 domains so you can understand the shape of SOC 2 readiness. A full SOC 2 programme spans 200+ controls; the readiness assessment tool scores all of them and prioritises your gaps.

Are all 12 domains required for SOC 2?

The first nine map to the SOC 2 Common Criteria, which every SOC 2 engagement includes. Confidentiality, Privacy, and Availability are additional Trust Services Criteria that apply only if you choose to include them in your audit scope.

What's the difference between this checklist and a gap analysis?

This checklist is a self-guided overview. A formal gap analysis is a consultant-led engagement with interviews, evidence sampling, and a written remediation roadmap. Most companies use a checklist or the readiness tool first, then commission a gap analysis if the result shows meaningful gaps.

What completion score means I'm ready for an audit?

As a rough guide, above 80% on this checklist suggests you are close, with remaining gaps usually in evidence and documentation rather than missing controls. Below 50% means significant control-building remains. The readiness tool gives a far more precise, weighted read than a simple checkbox count.