Run SOC 2 Control Self-Test Worksheet — Free

Inspection Scope & Readiness

Control scope matches the in-scope system and Trust Services Criteria critical (required)

Verify the worksheet is limited to the scoped services, locations, and Trust Services Criteria in the audit period.

Evidence period covers the audit window critical (required)

Confirm evidence dates fall within the period under review.

Yes No N/A

Control owner identified for each in-scope control critical (required)

Each control has a named owner responsible for operation and evidence retention.

Yes No N/A

Evidence repository is accessible and organized

Assess whether evidence can be retrieved quickly and consistently during auditor testing.

Security Controls

User access reviews completed on schedule critical (required)

Verify periodic access reviews were performed and exceptions were remediated.

Yes No N/A

Privileged access is restricted and approved critical (required)

Confirm elevated access is limited to authorized users with documented approval.

Yes No N/A

Change management evidence exists for sampled changes critical (required)

Check that sampled production changes have request, approval, testing, and deployment evidence.

Yes No N/A

Security logging and monitoring alerts are reviewed critical (required)

Confirm logs are generated, retained, and reviewed for suspicious activity.

Yes No N/A

Security incidents are tracked and investigated critical (required)

Verify incident records show triage, investigation, containment, and closure.

Yes No N/A

Availability & Resilience Controls

Backups are performed and monitored critical (required)

Verify backup jobs ran successfully and failures were remediated.

Yes No N/A

Restore test evidence is available critical (required)

Confirm a recent restore test was completed and documented with results.

Yes No N/A

Availability monitoring thresholds are defined

Check that uptime or service health thresholds are documented and monitored.

Yes No N/A

Business continuity or disaster recovery plan is current critical (required)

Verify the plan has been reviewed within the required cycle and reflects current dependencies.

Yes No N/A

Processing Integrity Controls

Input validation rules are documented and operating critical (required)

Confirm key data validation checks are defined and functioning as intended.

Yes No N/A

Exception handling and reprocessing are evidenced

Verify exceptions are logged, reviewed, and reprocessed where appropriate.

Yes No N/A

Output reconciliations are performed critical (required)

Check that output totals or reconciliations are reviewed for completeness and accuracy.

Yes No N/A

Confidentiality & Privacy Controls

Data classification and handling requirements are documented critical (required)

Verify confidential and personal data handling rules are defined for the scoped environment.

Yes No N/A

Encryption at rest and in transit is implemented where required critical (required)

Confirm encryption controls are enabled for systems and data in scope.

Yes No N/A

Data retention and disposal controls are followed

Check retention schedules and secure disposal evidence for records in scope.

Yes No N/A

Privacy requests or incidents are tracked to closure

Verify privacy-related requests, complaints, or incidents are documented and resolved.

Yes No N/A

Evidence Quality, Exceptions & Sign-Off

Exceptions and deficiencies are documented with owners and due dates critical (required)

Record any non-conformance, deficiency, or missing evidence discovered during the self-test.

Corrective actions have been assigned critical (required)

Confirm remediation owners and target dates are assigned for all open issues.

Yes No N/A

Inspector attestation critical (required)

Inspector confirms the worksheet was completed based on available evidence and observed results.

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Run: SOC 2 Control Self-Test Worksheet

Inspection Scope & Readiness

Security Controls

Availability & Resilience Controls

Processing Integrity Controls

Confidentiality & Privacy Controls

Evidence Quality, Exceptions & Sign-Off

Get your results