Framework toolkit
AICPA SOC 2 Type II Audit & Trust Services Toolkit
11 editable templates: 6 Excel, 5 Word. Each one is listed below with page 1 and its sections.
₹6,499 incl. GST
Review cart (0)- 11 files you can edit in Word and Excel
- UPI, card or netbanking through Razorpay
Three of the 11. Open one to see its full outline.
Word38 KB
SOC 2 Information Security Program Policy
- 1. Purpose
- 2. Scope
- 3. Governance and Control Environment
- 4. Risk Assessment
- + 4 more
Excel10 KB
SOC 2 Readiness Checklist
- Evidence examples
- SOC 2 Readiness
Excel9 KB
SOC 2 Control Matrix
- Control Matrix
What you get
All 11 files in this toolkit
Registers, logs and trackers2
-
SOC 2 Control Matrix
A control matrix mapping your controls to the SOC 2 criteria, with an owner, frequency and the evidence that demonstrates each control.
-
SOC 2 Evidence Request TrackerA tracker for the evidence the auditor requests (the 'provided by client', or PBC, list) during a SOC 2 examination, so nothing is missed and the audit runs smoothly.
Assessments and checklists4
-
-
SOC 2 Readiness RoadmapA roadmap to drive your SOC 2 gap assessment into a prioritised, owned action plan toward a SOC 2 Type I or Type II examination.
-
SOC 2 Risk AssessmentA risk assessment for SOC 2, supporting the risk-assessment criteria (CC3): identify risks to your service commitments and system requirements, assess them, and record…
-
SOC 2 Trust Services Criteria Gap AssessmentA gap assessment organised around the SOC 2 Common Criteria (CC1 to CC9) and the additional categories (Availability, Confidentiality, Processing Integrity, Privacy).
Plans, procedures and forms1
-
SOC 2 Incident Response Policy✎ Set your severity levels, customer-notification commitments and post-incident review and testing cadence.
Policies and standards3
-
SOC 2 Information Security Program Policy
✎ Set your security roles, how risks are assessed and controls monitored, and how commitments are communicated.
-
SOC 2 Logging and Monitoring Policy✎ Set your logging scope and retention, your monitoring and alerting tools, and how vulnerabilities are tracked.
-
SOC 2 Logical Access Control Policy✎ Set your approval and least-privilege process, MFA coverage, and access-review cadence.
Briefings and other documents1
-
SOC 2 System Description✎ Describe the in-scope services, boundaries, categories, commitments and subservice organisations.
₹6,499 incl. GST
How the files fit together
A suggested order
Our suggestion, not a requirement of the standard or the law.
- 1
Find the gaps
Start with the assessment workbooks to see where you stand.
4 files: SOC 2 Readiness Checklist, SOC 2 Readiness Roadmap, SOC 2 Risk Assessment, SOC 2 Trust Services Criteria Gap Assessment
- 2
Plan the work and the response
Use the plans, procedures and forms to set owners, dates and the steps to follow.
1 file: SOC 2 Incident Response Policy
- 3
Approve the policies
Edit the policies to match how you work, then get them approved.
3 files: SOC 2 Information Security Program Policy, SOC 2 Logging and Monitoring Policy, SOC 2 Logical Access Control Policy
- 4
Keep the records
Keep the registers and logs up to date as evidence for an audit or a review.
2 files: SOC 2 Control Matrix, SOC 2 Evidence Request Tracker
- 5
Brief your leadership
Use the briefing documents to explain the work to decision makers.
1 file: SOC 2 System Description
Questions
Before you buy
What exactly do I get?
11 editable files (6 Excel, 5 Word). Every file is listed on this page with its file name, size and number of sections.
How are the files delivered?
Digitally, after your payment is confirmed: we email download links to the address you gave at checkout. Each link works for 2 hours; you can ask for a fresh one from My purchases. Nothing is shipped.
How do I pay?
Through Razorpay, by UPI, card or netbanking.
Is GST included?
Yes. The price includes GST. To get a GST invoice, email [email protected] with your billing name, address and GSTIN.
Are these official documents of the standard body or regulator?
No. They are templates supplied by CynorSense Solutions Pvt. Ltd. They are not issued or endorsed by any standard body or regulator, and they are not legal advice. Using them does not by itself make an organisation compliant or certified.