Free SOC 2 readiness assessment

A free SOC 2 readiness assessment tells you one thing before you spend anything: how much work stands between you and a report. You answer questions about how your company actually runs. You get back a score and a gap list with real counts in it, not a sales call.

What a firm charges for the same thing

Readiness is normally the first paid engagement in a SOC 2. A consultant or audit firm interviews your team, reads what you have, and writes up the gaps. Here is what two published sources put that engagement at.

• Secureframe states that a professional SOC 2 readiness assessment typically costs between $10-17,000, and that cost depends on the size of your organization and the scope of your audit. Source, checked 2026-09-01.
• IS Partners, an audit and advisory firm, states that a professional SOC 2 readiness assessment can cost anywhere between $10,000 to $17,000, and that the assessment itself can take anywhere from a few weeks to a few months. Source, checked 2026-09-01.

We give that first read away. It costs us little to run, because the software does the interviewing and the counting. And a team that knows its gaps is a team that can decide for itself whether to go further. The guide to readiness assessments covers what a full engagement looks like if you want to compare.

How the assessment works

1. Create an account. Email and a password, or Google. No card, no phone call.
2. Answer the questions. They read like a survey about your company, not like a control catalog. Who has access to production, how code gets deployed, what happens when someone leaves.
3. Read your results. A readiness score, every gap category counted, and your first findings written out in full.

It takes about 15 minutes. You can stop halfway and pick it up later, and nothing you enter is shared with an auditor unless you choose to go ahead.

What the questions cover

The questions follow the areas an auditor will test, translated into how a small company actually talks. You will be asked about:

• Who can reach production systems and customer data, and whether MFA is on
• How code gets reviewed and deployed
• What happens when someone joins or leaves the team
• Which vendors and cloud services you depend on
• How you would notice and handle a security incident
• Backups, encryption and logging

If you do not know an answer, say so. A gap you find now costs little to fix. The same gap found by an auditor during fieldwork costs far more.

What you walk away with

The free tier is the readiness assessment, score, gap list and one AI sample policy. Concretely, that means you leave knowing which controls you already meet, which ones are open, and roughly how big each gap is. That is enough to answer a buyer honestly this week, even with no report in hand.

The sample policy matters more than it sounds. It is written from your own answers, so you can judge the quality of what the paid software would produce before you pay for it. If it reads like boilerplate, you have lost nothing.

Who it is for

Teams of two to fifty people. B2B software. A customer or prospect has asked for SOC 2, or you expect one to. Nobody on the team has compliance in their job title.

If that is you, the assessment is the easiest possible first step, because it is free. If you are further along, a company with a security team and a live audit, you probably know your gaps already. Our page on SOC 2 for startups goes through the whole path for a small team, and how long SOC 2 takes covers the calendar.

After the score

Most of the work after the assessment is closing gaps. You can do it with the paid software, with a consultant, or with a spreadsheet and patience. The gap list is useful whichever way you go.

If you want the software, it is one plan with the whole platform. See the full price list, including how audits work through our preferred pricing program. Or just start the free assessment and decide once you have seen your own numbers.