SOC 2 People-Ops Readiness Checker

On the people-ops side the testing clusters into four control categories. Hiring and onboarding: documented background checks before a start date, and security awareness training completed before or immediately upon system access. Access and segregation of duties: a written policy that no one person has end-to-end control of a sensitive process, and access reviews on a recurring schedule. Offboarding and access termination: a written policy stating a specific removal window, and records proving access was actually removed inside it. Documentation and training: a current handbook covering your real policies, tracked acknowledgment, recurring security training, and an org chart matching the actual reporting structure.

Because an auditor's findings are organized by control category, not as a total. A score of seven out of ten tells you nothing about which items get flagged, and two companies on seven can be in completely different positions. Reporting Pass, Partial Gap or Open Gap per category means the output maps directly onto whatever the auditor hands you later.

A Partial Gap means some items in that category are in place and some are not, so there is something to build on. An Open Gap means none of the items in that category are in place. The distinction matters because a partial category is usually a documentation or evidence problem, while an open one is usually a policy that was never written.

No. This covers the people-ops control categories only, and it asks what you believe to be true rather than testing your evidence. A SOC 2 report can only be issued by a licensed CPA firm, and nothing here is an audit, an opinion, or a readiness certification. Treat a clean result as a reason to keep your evidence current, not as a conclusion.