January+2022 - SOC 2 Checklist - February to April Mastermind

Sep 3, 2026

Upload by Aurora

SOC 2 checklist materials structured by monthly Mastermind themes, guiding organization-wide readiness across governance, communications, risk management, and monitoring. January focuses on executive buy-in, confirming technical and security owners, defining scope and timelines, and ensuring adequate time and resources. February emphasizes policy and procedure communication, documentation collection, gap analysis, and information security policy ownership. March adds risk assessment, asset inventory, risk registers, mitigation plans, and scanning. April covers audits, reviews, monitoring tools, training, access removal, and reporting actions.

LanguageEnglish

CategoryForms

FormatPDF

Pages22

Reading Time8 min

AccessFree to download

January Mastermind

Key Checks

February Mastermind

Key Checks

March Mastermind

Key Checks

April Mastermind

Key Checks

| In Plain English | January Mastermind | | --- | --- | | Organization and Management examines the leadership structure of your company to determine if there is a defined chain of command to ensure that every employee has a clear area of responsibility such that no critical task can "fall through the cracks . " | ❏ Buy-in from executives (CEO, CTO, COO)
❏ Confirm technical owners
❏ Confirm security officer ❏ Confirm business process owners ❏ Set expectations with scope and
timelines for upcoming projects ❏ Determine which systems and processes are in scope ❏ Hold kickoff meeting with internal
stakeholders to plan for the year ahead
❏ Ensure adequate time/resources available for security and compliance | | Key Checks | | | ❏ Visible structure and accountability from executive level ❏ Employee code of conduct
❏ Job/role descriptions and performance review structure ❏ Onboarding / offboarding checklists
❏ Job role and security training | | | In Plain English | February Mastermind | | --- | --- | | Communications means that you have written policies and procedures that cover major areas of risk and that you have a confirmed, well-maintained process for communicating those policies and procedures to employees, vendors, and customers. | ❏ Gather/Review/Update existing change management and SDLC documentation
❏ Gather existing technical system documentation and diagrams ❏ Gather existing HR forms and hiring
procedures
❏ Gather existing policies and procedures
❏ Each stakeholder performs “quick and dirty” gap analysis
❏ Review Information Security Policy
❏ Assign Information Security Policy sections to stakeholders for edits | | Key Checks | | | ❏ Network and Data Flow diagram
❏ Updated Org Chart with security responsibilities ❏ Information Security Policy and Acknowledgement ❏ Documented client security responsibilities ❏ Documented security commitments ❏ Established lines of communication | | | In Plain English | March Mastermind | | --- | --- | | Risk Management refers to the academic exercise of making sure you know all your organization's key technical and operational vulnerabilities, associated risks are well documented and addressed through controls, and reviewed on a regular basis. | ❏ Revise Information Security Policy ❏ Develop assessment process for
onboarding new technology vendors ❏ Request and review SOC 2 reports
for key service providers ❏ Develop system, data, and
workstation asset inventory ❏ Conduct a formalized risk
assessment
❏ Develop risk mitigation plan and identify additional controls ❏ Establish a vulnerability scanning process for key systems ❏ Engage with a penetration testing
firm | | Key Checks | | | ❏ Create a risk management policy ❏ Create an asset list with relevant data ❏ Create and complete a risk register ❏ Conduct the risk assessment ❏ Update control documentation | | | In Plain English | April Mastermind | | --- | --- | | Monitoring refers to the internal audits, reviews, and reports you regularly undertake to ensure that your internal controls are doing their jobs--especially when it comes to your information technology. | ❏ Develop checklists, process, and document storage routine for all processes surrounding new/ex hires
❏ Confirm background checks for all new hires
❏ Develop an employee handbook and code of conduct
❏ Review an acceptable use policy
❏ Review security awareness and job training material
❏ Update an org chart that clearly
shows security responsibilities ❏ Integrate security awareness training ❏ Ensure access is removed for all
termed employees | | Key Checks | | | ❏ Create (and perform) an internal audit process ❏ Review all key monitoring tools and configurations ❏ Perform External Penetration Testing
❏ Report to board of directors and/or executive team ❏ Perform preventative and corrective actions as needed | |

FAQs

What does January Mastermind focus on for SOC 2 readiness?

January centers on organization and management: establishing a leadership structure, confirming technical and security ownership, defining scope and timelines, and ensuring resources for security and compliance.

How does February Mastermind support SOC 2 communication requirements?

February emphasizes written policies and procedures and a maintained communication process, including gathering and updating documentation, reviewing the information security policy, and assigning policy sections to stakeholders for edits.

What key activities are included in March Mastermind risk management?

March requires revising the information security policy, creating an asset inventory and risk register, conducting a formal risk assessment, developing a risk mitigation plan with controls, and implementing vulnerability scanning and penetration testing.

Sep 3, 2026

Upload by Aurora