Kept logoKept

Free SOC 2 readiness checklist for UK businesses

Fifteen plain-English questions, a score out of 100 and a list of what to fix — then five free policy templates to close the gaps. Guidance only — only a licensed CPA firm can issue a SOC 2 report.

Your SOC 2 readiness check

  1. Scope

    1. Do you know which customer or contract is asking for SOC 2, and which services the report must cover?

  2. Policies

    2. Do you have written, approved security policies — access, change, incident, vendor and acceptable use?

  3. Governance

    3. Is one named person responsible for security and for the audit?

  4. Risk

    4. Have you done a written risk assessment in the last 12 months?

  5. Access

    5. Is multi-factor sign-in switched on for every staff account on email, cloud and code tools?

  6. Access

    6. Do you review who has access to your systems at least every three months, and keep a record?

  7. Access

    7. Is all access removed on a leaver's last day, with a checklist to prove it?

  8. Change management

    8. Are changes to your product reviewed and approved by someone other than the author before going live?

  9. Monitoring

    9. Are security logs collected and reviewed, with alerts for suspicious activity?

  10. Vendors

    10. Do you keep a list of suppliers that handle customer data, with their own security reports?

  11. Availability

    11. Are backups automatic and have you tested a restore in the last year?

  12. Incidents

    12. Do you have an incident response plan that has been tested?

  13. People

    13. Do staff complete security awareness training when they join and every year?

  14. People

    14. Do new starters sign a confidentiality agreement and have references checked?

  15. Devices

    15. Are staff laptops encrypted, updated and protected by a screen lock?

How you get a SOC 2 report, step by step

Twelve stages from “a customer asked for it” to a report in their hands. Each one says what to do and what to keep as proof. Times are typical for a small firm, not a promise.

  1. Get ready

    • Find out exactly what your customer wants

      SOC 2 is usually asked for by a US customer. Before spending anything, ask them what report they need.

      What to do:

      1. Email the customer and ask: do you need a SOC 2 Type 1 or Type 2 report?
      2. Ask which Trust Services Criteria they need — Security is always included; Availability and Confidentiality are common extras.
      3. Ask whether ISO 27001 or Cyber Essentials would be accepted instead — sometimes it is.
      4. Save their reply. That is your scope.

      Keep as proof: The customer's email saying what they need.

      Typical: A day

    • Take the free readiness check

      Fifteen plain-English questions show where you stand and what is missing.

      What to do:

      1. Open the SOC 2 readiness check using the link below.
      2. Answer each question honestly with Yes, Partly or No.
      3. Press See my score and write down every item on the What to fix list.

      Keep as proof: Your score and the list of gaps.

      Typical: 15 minutesSOC 2 readiness check

    • Write down what the report covers

      One paragraph listing the product, the systems behind it and the people who run it.

      What to do:

      1. Name the product or service the customer uses.
      2. List every tool behind it — hosting, code, email, support desk.
      3. List the people who can access those tools.
      4. Save this as your system description.

      Keep as proof: A one-page system description.

      Typical: Half a day

  2. Close the gaps

    • Check the settings in each of your tools

      Pick the tools you use and Kept tells you which settings to switch on and exactly where to click.

      What to do:

      1. Open the SOC 2 page in your Kept workspace using the link below.
      2. Tick every tool your company uses.
      3. For each setting, tick it if it is already done.
      4. Work through the gaps list — each one says where to click.

      Keep as proof: Screenshots of each setting switched on.

      Typical: 1–2 daysTool gap finder

    • Write and approve your policies

      Auditors ask for five core policies first. Kept's free templates give you a starting draft.

      What to do:

      1. Download the free SOC 2 templates using the link below.
      2. Replace every [bracket] with your own names and details.
      3. Ask a director to read, sign and date each one.
      4. Send the policies to all staff and keep a record that they read them.

      Keep as proof: Signed policies and a staff acknowledgement list.

      Typical: 1 weekFree SOC 2 templates

    • Do a risk assessment

      A simple table of what could go wrong, how likely it is, and what you are doing about it.

      What to do:

      1. List ten things that could go wrong — hacked account, outage, lost laptop, supplier breach.
      2. Score each from 1 to 3 for likelihood and impact.
      3. Write what you are doing about each and who owns it.
      4. Have a director sign it off.

      Keep as proof: A signed risk assessment.

      Typical: Half a dayRisk register template

    • Train your staff

      Everyone with access needs security training on joining and every year.

      What to do:

      1. Send everyone the link to Kept's free staff training below.
      2. Ask each person to pass the quiz and download their certificate.
      3. Save every certificate in one folder.

      Keep as proof: A training certificate for each person.

      Typical: 1 hour per personFree staff training

    • Collect your evidence in one place

      Auditors ask for proof. Keep screenshots, exports and signed documents together.

      What to do:

      1. Open the Evidence Vault using the link below.
      2. Upload each screenshot, policy and access review as you go.
      3. Give each file a clear name like 'GitHub branch protection – Nov 2026'.

      Keep as proof: A complete evidence folder.

      Typical: OngoingEvidence Vault

  3. Audit

    • Choose a licensed audit firm

      Only a licensed CPA firm can issue a SOC 2 report. Get two or three quotes.

      What to do:

      1. Search for 'SOC 2 auditor' and shortlist three firms that work with small companies.
      2. Send each your system description and ask for a quote for the report type your customer wants.
      3. Check the firm is a licensed CPA firm before signing.

      Keep as proof: The signed engagement letter.

      Typical: 2–4 weeks

    • Type 1: show your controls exist

      A Type 1 report checks your controls are in place on a single date. Many firms start here.

      What to do:

      1. Agree the audit date with the auditor.
      2. Send them the evidence they ask for — policies, screenshots, user lists.
      3. Answer their follow-up questions quickly.

      Keep as proof: The Type 1 report.

      Typical: 4–8 weeks

    • Type 2: show your controls work over time

      A Type 2 report checks your controls worked throughout a period, usually 3 to 12 months.

      What to do:

      1. Agree the observation period with the auditor.
      2. Keep doing every control on schedule — quarterly access reviews, approvals, training.
      3. Save proof each time in the Evidence Vault.
      4. At the end, send the auditor the evidence they sample.

      Keep as proof: The Type 2 report.

      Typical: 3–12 monthsEvidence Vault

  4. Keep it

    • Share your report and plan next year's

      SOC 2 reports are usually renewed every year. Keep the dates in Kept and we will remind you.

      What to do:

      1. Share the report with your customer under a confidentiality agreement.
      2. Open the SOC 2 tracker using the link below.
      3. Enter the report date and the date of your next audit.
      4. Act on the first reminder Kept sends, not the last.

      Keep as proof: The report and next year's audit date.

      Typical: YearlySOC 2 tracker

Growth customers can tick these off as they go in their Kept workspace, with the tool gap finder and audit reminders alongside them. See the plans.

Free SOC 2 policy templates

  • Information security policy — The top-level policy auditors ask for first, signed by management.
  • Access control policy — Who gets access, how it is approved, reviewed every quarter and removed.
  • Change management policy — How changes are reviewed, tested and approved before going live.
  • Vendor management policy — How you check and review suppliers that handle customer data.
  • Incident response plan — Who does what when something goes wrong, and how you tell customers.

We store your details to follow up about compliance. See our privacy notice.

Kept is an independent tool. It is not affiliated with or endorsed by the AICPA or any audit firm. This page is general guidance, not audit or legal advice.