Free SOC 2 Evidence Gap Checklist
Before buying a GRC platform or requesting an auditor quote, spend ten minutes checking whether your team can point to reproducible evidence. This is a readiness screen, not a certification test.
Mark each item: owner, link, and last reviewed date
- Every production service has one named scope owner.
- Access reviews have an owner, date, and retained result.
- Changes link a reviewer, deployment, and rollback evidence.
- Incident records include timeline, decision, and follow-up owner.
- Backups have a restore test result, not only a success notification.
- Vendors have an inventory, risk decision, and review cadence.
- Security training has a roster and completion evidence.
- Risk exceptions have an expiry date and accountable approver.
- Monitoring alerts have an escalation path and sample resolution.
- A CPA can trace each selected control to one evidence location.
What to do with the result
If more than three items lack an owner or reproducible link, do not start by buying more software. Narrow the system boundary, assign owners, and ask a CPA which evidence they will actually test. Then use the evidence binder to turn the list into a 30-day readiness sprint.