HARTGATEADVISORY
Menu

SOC 2 readiness check

Fifteen questions about the controls auditors look at first. You will see your score and top three gaps right away, with no sign-up. It takes about four minutes.

0 of 15 answered

1Do you know which customer or deal is driving SOC 2, and whether they need a Type 1 or Type 2 report?

Scope

2Have you written down which products, systems, and data are in scope for the audit?

Scope

3Do you have written security policies that leadership has approved and employees have acknowledged?

Governance

4Is one named person accountable for security and compliance, with time set aside for it?

Governance

5Is multi-factor authentication enforced on email, cloud consoles, code repositories, and other critical tools?

Access

6Do you review who has access at least quarterly, and remove access within a day when someone leaves?

Access

7Do new hires sign an acceptable use policy, complete security training, and go through a background check where lawful?

People

8Is every code change reviewed and approved by someone other than the author before it reaches production?

Change management

9Do you collect logs from production systems and get alerted to suspicious or failed activity?

Monitoring

10Do you have a written incident response plan that the team has practiced in the last 12 months?

Incident response

11Are production backups automated, and have you tested restoring from them in the last 12 months?

Availability

12Is customer data encrypted at rest and in transit?

Data protection

13Have you documented a risk assessment in the last 12 months, with owners and planned treatments for each risk?

Risk assessment

14Do you keep an inventory of vendors that handle your data and review the critical ones before and after signing?

Vendor management

15If you use Vanta, Drata, or a similar platform, are its integrations connected and its failing tests being worked down?

Tooling

Your answers stay in your browser unless you choose to send them to us after you see your results.