Scope the system
Legal entity, products, infra, and vendors that are in. Everything else is a reason for not applicable.
Resources · SOC 2 guide
Readiness is a register. The report is a firm.
SOC 2 is not a badge you buy from a SaaS product. It is an independent examination. ReadyComply exists so the examination is not a scavenger hunt.
The distinction
Software cannot issue an attestation.
A licensed CPA firm examines controls over a period (Type II) or at a point in time (Type I) and issues a report. ReadyComply can hold the criteria, the evidence, the policies, and the gaps. It cannot sign the opinion.
The work
What readiness actually is.
Name applicable criteria
Security at minimum. The rest only if you will evidence them.
Write how each control operates
Not the AICPA text. Your implementation, your owner, your exceptions.
File evidence and close gaps
Artifacts with dates. Tasks with owners. A trail of who changed what.
Where ReadyComply stops
It does not score you as compliant.
There is no passing grade in the product. Status is a human field. Connectors, when they exist, attach evidence. They do not close the opinion. If a page on this site sounds like a certificate, it is wrong.
Framework
The SOC 2 product page.
Workspace
The four records.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Open the workspace. Keep the register current.
Sign in. Create the first system. Start with what you can already prove.
Sign in