SOC 2 Readiness Checklist for On-Prem and Hybrid Infrastructure

A SOC 2 readiness checklist lists the work a company needs to finish before its audit starts: scope the system, write the policies, and build the security controls that produce evidence an auditor can sample. For companies running their own hardware, the checklist also has to cover what cloud checklists leave out, such as server management ports, firewall firmware and the colocation provider's SOC 2 report.

Take a company with production on rented racks in a colocation facility and a cloud control plane. A cloud-focused checklist asks about IAM roles. It says nothing about who holds admin access to the iDRAC on each server, whether the firewall firmware is patched, or how a server gets rebuilt after an outage at the only site. An auditor asks all three.

What Does a SOC 2 Readiness Checklist Cover?

A SOC 2 readiness checklist covers scoping first, then the security capabilities that the AICPA Trust Services Criteria test: access, monitoring, change management, risk, vendors and recovery. The on-prem checklist groups its 76 tasks like this:

Phase 0: SOC 2 Scoping Tasks for On-Prem and Hybrid Systems

SOC 2 scoping decides which systems, sites and teams the audit covers, and every later task depends on it. The seven scoping tasks are:

• Define the system boundary (products, environments, teams, locations).
• Write the system description, which the AICPA Description Criteria govern.
• Draw the network diagram and the data flow diagram.
• Build the asset inventory, including servers, hypervisors, firewalls, switches and BMCs.
• Write policies, then turn them into a calendar of weekly, monthly and quarterly tasks in a Security Program Manual.

The on-prem difference is in the boundary. Colo sites, on-prem racks and the cloud control plane each need to appear separately, and the colo and cloud providers are usually carved out as subservice organizations. The hybrid and on-prem scoping guide covers boundary decisions in detail.

Phase 1: SOC 2 Build Tasks by Security Capability

The build phase holds 69 tasks across 15 security capabilities. Each task in the spreadsheet names the evidence it produces, so a team can check readiness by asking does this record exist? for every row.

Access, Network and Encryption Tasks for On-Prem SOC 2

Access and network tasks prove that only the right people reach production and that production is not open to the internet. Example tasks: deploy SSO where possible, enable MFA, review local accounts on servers and databases, keep super admins to two or three, confirm no SSH or RDP is open to the internet, and separate production from non-production networks. On-prem, the list grows to include MFA on BMC/iDRAC interfaces, firewall firmware patching, and full-disk encryption on physical servers.

Logging, Configuration and Endpoint Tasks for On-Prem SOC 2

Visibility tasks are the largest group, with 26 tasks, and usually take the longest on-prem, because every server, hypervisor and network device needs an agent or a log forwarder. Example tasks: pick a SIEM (SaaS or self-hosted), send logs from every in-scope host, compare SIEM sources with the asset inventory, alert on hosts that stop sending logs, and scan servers against a CIS benchmark.

Change Management Tasks for SOC 2

DevSec tasks show that code reaches production through a controlled path: branch protection, required review or tests before merge, MFA on the repository and CI/CD tools, and code scanning. On-prem, the checklist adds self-hosted runners and image scanning for the on-prem cluster.

Resilience and Governance Tasks for On-Prem SOC 2

Resilience and governance tasks cover what happens when something breaks and who the company depends on. Example tasks: an initial risk assessment that includes single-site and hardware failure risks, a vendor list with the colo provider's SOC 2 report and bridge letter, an incident response plan with colo contacts and the remote-hands procedure, scheduled off-site backups, and a timed restore test. A second data center is optional: the high availability task applies only if Availability is in scope and the company's commitments require it.

How to Run a SOC 2 Readiness Assessment With the Checklist

A SOC 2 readiness assessment compares what is in place today with what the audit will test, and the spreadsheet turns that into a status per task. Five steps:

1. Mark out-of-scope tasks N/A first. If Availability or Privacy is not in scope, mark those tasks N/A and write the reason in Notes.
2. Set a status for every remaining task. Done means the control runs and the evidence listed in the Evidence produced column exists today. A control that runs but leaves no record is In progress.
3. Add an owner and a target date to every task that is not Done. Unowned tasks are the ones that slip.
4. Read the Progress tab. It shows % done for each phase and each capability, which makes the weakest capabilities obvious.
5. Start the long tasks first. Logging, configuration scanning and restore testing take the most calendar time on-prem, so they go first even if other gaps look bigger.

For a quicker first pass, the free SOC 2 readiness scorecard scores a program in about five minutes. The checklist is the line-by-line version for the team that will do the work. Once tasks reach Done, the on-prem SOC 2 evidence collection guide covers how to capture and store the evidence for the audit.

When to Bring In Help for SOC 2 Readiness

Outside help pays off when the checklist shows gaps across many capabilities at once, or when the people who run the infrastructure are also the only people who can build the controls. The SOC 2 readiness for bare metal SaaS post explains what the assessment, build and audit preparation phases look like and what drives the timeline.

Three signs a team needs support:

• More than a third of the checklist is Not started and an audit date is already set in a customer contract.
• The scoping tasks are unclear, for example which colo controls are carved out and which are the company's own.
• Policies exist but were written for a cloud environment and do not match how the racks are run.

Truvo builds SOC 2 programs for companies on bare metal and colocation infrastructure, using the same checklist.

Related Guides

• On-Prem SOC 2 Cost and Timeline: What Changes When You Run Your Own Hardware
• SOC 2 for Hardware Startups: What's in Scope When You Sell Devices, Chips or Appliances

Frequently Asked Questions

What is a SOC 2 readiness checklist?

A SOC 2 readiness checklist is a list of the tasks a company completes before a SOC 2 audit: scoping, policies and the security controls the Trust Services Criteria test. A useful checklist also names the evidence each task produces.

What is the difference between a SOC 2 readiness assessment and a SOC 2 audit?

A SOC 2 readiness assessment is an internal or advisory check of how close a company is to meeting the criteria. A SOC 2 audit is performed by an independent CPA firm and results in the SOC 2 report. A readiness assessment produces no report for customers; it produces a list of gaps to close.

Is there a SOC 2 readiness assessment checklist in XLS format?

Yes. Truvo's SOC 2 readiness checklist, available on request through the contact page, is an Excel spreadsheet with 76 tasks for on-prem, colocation and hybrid infrastructure. It includes owner, target date and status columns, a status dropdown, and a progress tab with live formulas for % done by phase and capability.

How long does SOC 2 readiness take for on-prem infrastructure?

Most on-prem SOC 2 readiness engagements finish within about three months, according to Truvo's bare metal readiness guide. Team availability affects the timeline more than infrastructure complexity, because the same engineers run production and build the controls.

Does every task on the SOC 2 readiness checklist apply?

No. The SOC 2 readiness checklist covers the Security criteria plus common additions such as Availability and Confidentiality. Tasks tied to criteria outside the audit scope, such as a mirror environment when Availability is out of scope, can be marked N/A with a short reason the auditor can follow.

Sources

• AICPA 2017 Trust Services Criteria (revised points of focus 2022)
• AICPA Description Criteria for a SOC 2 report (DC 200)
• Truvo, SOC 2 Readiness for Bare Metal SaaS (timeline: most on-prem engagements complete within 3 months; team availability is the main variable)
• Truvo CEO task list: security program build checklist for on-prem and hybrid environments (76 tasks, criteria mapping as a starting point)