SOC 2 templates and checklists

Policies, registers, checklists and letters, printed in full on the page, most with Word, PDF or Excel downloads. No email address, no form.

Policies

The information security policy template, with the policies it governsThe umbrella policy an auditor reads first: roles, oversight and an index of the other twelve.9 min read The access control policy template, printed in fullAccounts, passwords, approvals, reviews and leavers, written so the records can prove it.7 min read An acceptable use policy template your team can signThe rules for company accounts, laptops and data, with the acknowledgment each person signs.7 min read The change management policy template for SOC 2How code and infrastructure reach production, and the record each change leaves behind.6 min read The vendor management policy template, tiered by reachWhich vendors get assessed, how hard, how often, and what the contract has to say.6 min read The data retention policy template, with classification and disposalFour data levels, how each is handled, how long each record is kept and how it is destroyed.8 min read The encryption policy template, at rest and in transitWhat gets encrypted, with what, where the keys live and when they rotate.6 min read The business continuity and disaster recovery plan templateRecovery targets, backups, the restore test that proves them, and what to do on the day.7 min read Incident response plan template (SOC 2), free and sized for five peopleTwo or three pages you can follow at 2am beat twenty you cannot. Here is the short version, ready to copy.6 min read The risk assessment policy template, with a scoring scaleHow risks are found, scored, treated and accepted, and what makes you look again.6 min read The vulnerability management policy template, with fix deadlinesWhere findings come from, how fast each severity is fixed, and who can accept the rest.6 min read The logging and monitoring policy template, with the alerts to setWhat gets logged, who cannot touch the logs, which events alert someone, and who looks.6 min read The security awareness training policy template, with a training logWho is screened and trained, when, on what, and the log that proves it happened.8 min read

Registers and checklists

A free user access review template you can fill in todayOne sheet per system, one row per account, and a header that proves nothing was left out. Download it free and run your first review this week.5 min read A free SOC 2 risk register template with real rowsA blank grid teaches nothing, so this one comes with six rows already written. Download the workbook, replace the rows, keep it current.5 min read Vendor security assessment questionnaire template, free to sendSort your vendors first, then send questions only to the few that can reach your data. All 24 are free to copy or download.5 min read A free employee offboarding checklist template, with owners and proofEighteen steps, each with an owner and the proof it leaves. Free to copy or download, no email required.5 min read

Letters and answers

SOC 2 management assertion: two letters you can copySection 2 is a one page letter, and a person at your company signs it. Here are both versions, free to copy or download.7 min read A free SOC 2 system description template, part by partYou write Section 3, not the auditor. Here is every part, a filled example, a worked boundary, and the wording that comes back.7 min read How to answer a security questionnaire before you have a SOC 2Twelve questions come back on every form. Here are honest answers for today and for after your report, free to copy.6 min read

Get audit-ready without a compliance team

The readiness assessment is free, and every price on this site is the price. No quote gate.

Start free