Scoping checklist
SOC 2 Scoping Checklist: What to Have Ready Before the Call
Before a SOC 2 scoping call, have ready who asked for the report and which type they will accept, the systems and teams the report should cover, any Trust Services Criteria beyond Security that customers ask about, your cloud providers and other subservice organisations, the policies and tools you already run, the observation window you can work with, and the date the deal needs the report. SecureRoot uses that to agree a written scope and a fixed price after one call of 30 to 45 minutes. No credentials, keys, personal data or customer datasets are needed at scoping.
About this help article
Written by SecureRoot Risk Advisory LLP.
Start here
Who asked, and for which report
Most SOC 2 projects start with a customer's security questionnaire or contract clause. That request decides more of the scope than anything else, so bring it.
- The customer, prospect or partner asking, and the exact wording of their request (a questionnaire line, a contract clause or an email).
- Whether they named Type 1 or Type 2. A Type 1 report judges control design at a point in time; a Type 2 tests that controls operated across a period. If they did not say, ask them before the call; the trade-off is set out in our Type 1 versus Type 2 guide.
- Whether they will accept something else in the meantime, such as a Type 1 while a Type 2 window runs.
- Other customers asking the same question, so one report answers all of them.
Scope
The systems the report should cover
A SOC 2 report describes a system: the service your customers rely on and the infrastructure, people and processes behind it. Names and counts are enough.
- The product or service in scope, and any you want left out.
- Where it runs: production environments, regions and the main components (application, databases, queues, storage).
- How code reaches production: repositories, the CI/CD tool and who can deploy.
- Identity: the identity provider and roughly how many staff and contractors have access to production.
- The teams involved (engineering, IT, HR, support) and approximate headcount.
Criteria
Criteria beyond Security
Security is always in scope. Availability, confidentiality, processing integrity and privacy are optional, and each one you add brings more controls, more evidence and a longer audit. Bring the reason for any you are considering.
- Availability: an uptime commitment or SLA in your contracts.
- Confidentiality: contractual restrictions on how you handle customer data.
- Processing integrity: where the correctness of a transaction is the product, as in payments or payroll.
- Privacy: where customers ask about personal data handling, which overlaps with DPDP Act and GDPR work you may already be doing.
SecureRoot reads your contracts and questionnaires during scoping and recommends the smallest set of criteria that answers them.
Third parties
Cloud providers and subservice organisations
- Your cloud and hosting providers.
- Other vendors that run part of the system for you: managed databases, payment processors, email and messaging services, support desks, outsourced IT or development.
- Which of those can give you their own SOC 2 report, and whether you already hold a current copy.
A list of names is enough. The auditor's treatment of each vendor is settled later, with the CPA firm.
Starting point
Existing policies and tools
Where you start sets where you land in the price band, so be specific about what already runs and what exists only on paper.
- Written policies you have today (access, change management, incident response, vendor management), and whether they are approved and followed.
- Controls already operating: access reviews, MFA, logging and monitoring, backups, onboarding and offboarding.
- A compliance platform, if you use or are evaluating one, such as Vanta, Drata, Sprinto, Scrut or Secureframe. The platform's subscription is quoted by its vendor, not by SecureRoot.
- Recent penetration test reports, other audits or certifications, and any completed security questionnaires.
Timing
The observation window and the deal deadline
- For a Type 2, the observation window you can work with. Windows are usually three to twelve months; a first report commonly uses three to six.
- The date the deal needs the report, and whether that date is firm or a target.
- Any fixed constraints: a funding round, a renewal, a product launch or a freeze period.
For planning, SecureRoot's published timelines are a Type 1 in 8 to 12 weeks and a first Type 2 in 6 to 9 months, assuming a three-month observation window. The CPA firm's fieldwork follows. If the deadline cannot be met, the scoping call is where we say so.
Not needed
What you do not need to send
No credentials, keys, personal data or customer datasets are needed at scoping. Do not send passwords, API keys, tokens, production data or customer records. Access to evidence sources is arranged only after the scope and contract are agreed.
What happens next
After the call
SecureRoot sends a one-page written scope saying what is in, what is out and what you supply, then a fixed price against it. The published band for readiness and audit support is ₹1.5 lakh to ₹4.5 lakh, the same for either report type. The licensed CPA firm's audit fee is separate: SecureRoot introduces partner CPA firms during scoping, and you contract with the one you choose directly.
Scope boundaries
What this does not cover
- SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does, independently of our readiness work.
- A scoping call produces a written scope and a price, not an assessment of your controls; the gap assessment comes after you engage.
- Readiness does not guarantee a report without exceptions; the auditor decides what it reports.
- Your own team's time producing evidence sits outside every quote.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-13
- 2018 SOC 2 Description Criteria (With Revised Implementation Guidance, 2022)
AICPA and CIMA · Link checked 2026-11-13
Related
Services and help that go with this
- SOC 2 Type 1 vs Type 2
Which report type to ask for, if your customer has not said.
- Your responsibilities in SOC 2 readiness
What your team supplies once the engagement starts.
- SOC 2 compliance checklist
The criteria and the evidence an auditor samples.
- SOC 2 readiness and audit support
The six phases and their deliverables.
- Choosing a framework or report
If you are not sure SOC 2 is the right answer to the request.
- Pricing
Published bands and the fees that sit outside them.
Have the checklist ready?
Bring it to a 30 to 45 minute call. SecureRoot follows with a written scope and a fixed price.