Get the playbook →
Free guide · November 2026 edition

The SOC 2 Readiness Playbook

A practical, source-checked guide to getting your first SOC 2 report, and keeping it. Written for founders, CTOs and security leads who just got the question: "Can you share your SOC 2 Type 2?"

  • Type 1 vs Type 2, and how to choose an observation period
  • The five Trust Services Categories, and which belong in your scope
  • Scoping vendors (carve-out vs inclusive) and customer controls (CUECs)
  • A 10-phase roadmap and a criteria-mapped readiness checklist
  • What the AICPA's proposed 2027 criteria mean for you, including the new AI points of focus

Get the free playbook

One click with LinkedIn, or fill in the form.

Continue with LinkedIn
or
Details filled in from LinkedIn — just add your company.

We use your details to send the playbook and to follow up about SOC 2 readiness. See our privacy policy. Signing in with LinkedIn shares only your name, email and profile photo with us. We never post on your behalf.

Your playbook is ready

Opening it now. Use "Save as PDF" at the top to keep a copy.

Open the playbook

Want help scoping your SOC 2? Book a 30-minute call.

What's inside

Fifteen sections, built from AICPA primary sources. No invented statistics, no "SOC 2 certified" shortcuts.

What SOC 2 is, and isn'tAttestation vs certification, SOC 1/2/3, and the wording buyers' risk teams trust.
Type 1 vs Type 2How to pick, and how to choose an observation period against your control calendar.
Trust Services CriteriaThe five categories, the nine Common Criteria series, and how to scope deliberately.
Inside the reportThe five sections, opinion types and exceptions, read the way a buyer reads them.
Scoping that sticksSystem boundary, subservice organisations, CSOCs, CUECs and service commitments.
Roadmap and checklistA 10-phase sequence and a criteria-mapped readiness checklist you can use this week.
New: the proposed 2027 SOC 2 criteria. On 28 October 2026 the AICPA asked for comment on proposed 2027 Trust Services Criteria, including new points of focus on AI governance, model monitoring, prompt manipulation, data poisoning and training-data management. Comments are due 15 January 2027. If approved, the criteria would apply to engagements beginning on or after 31 December 2027, with early adoption permitted. The playbook explains what it means for your next report.
Built and operated by Fusionpact Technologies Inc. Fusionpact: SOC 2 Type II examination completed; report available under NDA