SOC 2 Readiness

1

1. Do all employees and contractors use MFA for systems containing company or customer data?

Yes, everyone

Most users

Some users

No

2

2. Do you regularly review who has access to production systems and sensitive data?

Yes, at least quarterly

Yes, but less frequenly

We do this occasionally

No formal access reviews

3

3. Is access removed promptly when an employee or contractor leaves the company?

Yes, through a documented process

Usually, but manually

It depends on the situation

No formal process

4

4. Do you regularly scan your systems for vulnerabilities?

Yes, automatically and regularly

Yes, but manually/infrequently

We are starting to implement this

No

5

5. Do you monitor your production environment for security events?

Yes, continuously/automatically

Yes, but with limited coverage

Some monitoring exists

No

6

6. Do you have documented information security policies?

Yes, comprehensive and current

Yes, but some need updating

A few basic policies

No

7

7. Do you have a defined owner responsible for your security/compliance program?

Yes, with clearly defined responsibilities

Someone owns it informally

multiple people share responsibility

No

8

8. Do you have a documented incident response plan?

Yes, documented and current

Yes, but it needs upddating

Informal process

No

9

9. Do you assess the security risk of vendors before working with them?

Yes, using a documented process

Sometimes

Informally

No

10

10. Could you quickly produce evidence showing that your security controls are actually operating?

Yes, evidence is organized and readily available

Mostly, but it's spread across different systems

It would take significant manual work

We don't systematically collect evidence

11

Your Name* This field is required.

First Name

Last Name

12

Your work email* This field is required.

example@example.com

13

Your company email* This field is required.

14

Your Score