Page 1 of 5
SOC 2 Readiness Assessment
Part 1 of 3 — Access & Data Protection
These questions assess your core security infrastructure — who can access what, and how you protect data.
Which of these require MFA at your company today?
*
q1_mfa [0]
A
None — we use passwords only
B
Email only
C
Production systems and/or admin accounts only
D
Every SaaS tool and production system, enforced company-wide
How often do you formally review who has access to customer data?
*
q2_access [0]
A
We've never done a formal access review
B
Ad-hoc, when something goes wrong
C
Quarterly
D
Monthly — or continuously via an automated tool
Is customer data encrypted at rest and in transit?
*
q3_encrypt [0]
A
I'm not sure
B
In transit only (HTTPS, TLS)
C
Both, in most systems
D
Both, in every system, with documented key management
Do you maintain an inventory of every third-party vendor that accesses customer data?
*
q4_vendor [0]
A
No
B
In scattered spreadsheets or docs
C
Yes, centralized in one place
D
Yes, centralized, with annual risk reviews on each vendor
Are critical system logs (authentication, data access, production changes) centralized and retained?
*
q5_logging [0]
A
No central logging
B
Some logs exist, but stored locally on each system
C
Centralized, but retained less than 90 days
D
Centralized, retained 1+ year, with alerts on key events
Next