soc2-readiness-check

Evaluate SOC 2 Type II readiness across the 5 Trust Service Criteria with gap analysis, remediation prioritization, and audit cost/timeline estimation.

Install

Python:

pip install soc2-readiness-check

JavaScript:

npm install soc2-readiness-check

Quick Start

Python

from soc2_readiness_check import (
    check_readiness,
    get_control_checklist,
    gap_analysis,
    estimate_timeline,
    estimate_cost,
)

# Score your controls (0-100 per control)
responses = {
    "SEC-01": 85,  # RBAC implemented
    "SEC-02": 90,  # MFA enforced
    "SEC-04": 70,  # Firewalls documented
    "AVL-01": 40,  # BCP needs work
    "CON-01": 60,  # Data classification in progress
}

# Check overall readiness
result = check_readiness(responses)
print(f"Overall readiness: {result['overall_score']}%")
print(f"Passing: {result['passing']}")
for criteria, score in result["criteria_scores"].items():
    status = "PASS" if result["criteria_pass"][criteria] else "FAIL"
    print(f"  {criteria}: {score}% [{status}]")

# Get prioritized gaps
gaps = gap_analysis(responses)
for gap in gaps[:5]:
    print(f"[{gap['severity'].upper()}] {gap['control_id']}: {gap['description']}")
    print(f"  Score: {gap['score']}% | Effort: {gap['remediation_effort']}")

# Estimate timeline and cost
timeline = estimate_timeline(result["overall_score"], "type2")
print(f"Estimated time to audit-ready: {timeline['weeks_low']}-{timeline['weeks_high']} weeks")

cost = estimate_cost("midmarket", criteria_count=3, audit_type="type2")
print(f"Estimated cost: ${cost['low']:,} - ${cost['high']:,}")

JavaScript

const {
  checkReadiness,
  getControlChecklist,
  gapAnalysis,
  estimateTimeline,
  estimateCost,
} = require("soc2-readiness-check");

// Score your controls (0-100 per control)
const responses = {
  "SEC-01": 85,
  "SEC-02": 90,
  "SEC-04": 70,
  "AVL-01": 40,
  "CON-01": 60,
};

// Check overall readiness
const result = checkReadiness(responses);
console.log(`Overall readiness: ${result.overall_score}%`);
console.log(`Passing: ${result.passing}`);

// Get prioritized gaps
const gaps = gapAnalysis(responses);
gaps.slice(0, 5).forEach((gap) => {
  console.log(`[${gap.severity.toUpperCase()}] ${gap.control_id}: ${gap.description}`);
});

// Estimate timeline and cost
const timeline = estimateTimeline(result.overall_score, "type2");
console.log(`Time to audit-ready: ${timeline.weeks_low}-${timeline.weeks_high} weeks`);

const cost = estimateCost("midmarket", 3, "type2");
console.log(`Cost range: $${cost.low.toLocaleString()} - $${cost.high.toLocaleString()}`);

API Reference

check_readiness(responses) / checkReadiness(responses)

Evaluates SOC 2 readiness from scored responses across control domains.

Parameters:

| Name | Type | Description | |------|------|-------------| | responses | dict / object | Map of control IDs (e.g., "SEC-01") to scores (0-100). Controls not present are scored as 0. |

Returns: Object with:

• overall_score (number) -- Weighted average across all controls (0-100)
• criteria_scores (object) -- Per-criteria weighted scores
• criteria_pass (object) -- Per-criteria pass/fail (threshold: 70%)
• passing (boolean) -- true if all criteria pass
• controls_evaluated (number) -- Count of controls with responses
• controls_total (number) -- Total controls (45)

get_control_checklist(criteria) / getControlChecklist(criteria)

Returns checklist items for specified criteria.

Parameters:

| Name | Type | Default | Description | |------|------|---------|-------------| | criteria | string | "all" | One of: "security", "availability", "processing_integrity", "confidentiality", "privacy", or "all" |

Returns: Array of control objects, each with: id, category, criteria, description, weight.

estimate_timeline(readiness_score, audit_type) / estimateTimeline(readinessScore, auditType)

Estimates weeks to audit-ready based on current readiness score.

Parameters:

| Name | Type | Default | Description | |------|------|---------|-------------| | readiness_score | number | -- | Overall readiness percentage (0-100) | | audit_type | string | "type2" | "type1" or "type2" |

Returns: Object with weeks_low, weeks_high, readiness_score, audit_type.

estimate_cost(company_size, criteria_count, audit_type) / estimateCost(companySize, criteriaCount, auditType)

Estimates audit cost range based on company size, scope, and audit type.

Parameters:

| Name | Type | Default | Description | |------|------|---------|-------------| | company_size | string | -- | "smb", "midmarket", or "enterprise" | | criteria_count | integer | 1 | Number of Trust Service Criteria in scope (1-5) | | audit_type | string | "type2" | "type1" or "type2" |

Returns: Object with low, mid, high (USD), company_size, criteria_count, audit_type.

gap_analysis(responses) / gapAnalysis(responses)

Identifies gaps and prioritizes remediation based on scored responses.

Parameters:

| Name | Type | Description | |------|------|-------------| | responses | dict / object | Map of control IDs to scores (0-100). Missing controls treated as 0. |

Returns: Prioritized array of gap objects (critical first), each with:

• control_id, category, criteria, description
• score -- Current implementation score
• gap -- Points below 100
• severity -- "critical" | "high" | "medium" | "low"
• remediation_effort -- "high" | "medium" | "low"
• priority_rank -- 1-based rank

Control Checklist Overview

45 controls across the 5 Trust Service Criteria:

| Criteria | Controls | Categories | |----------|----------|------------| | Security | 15 | Access Control, Network Security, Vulnerability Management, Monitoring & Logging, Incident Response, Change Management | | Availability | 8 | Business Continuity, Disaster Recovery, Capacity Planning, Uptime Monitoring | | Processing Integrity | 7 | Data Validation, Quality Assurance, Error Handling, Output Verification | | Confidentiality | 8 | Data Classification, Encryption, Data Handling, Third-Party Management | | Privacy | 7 | Notice & Consent, Data Rights, Data Minimization, Privacy by Design |

Each control has a weight from 1 (advisory) to 5 (critical). Weights influence the weighted readiness score and gap severity classification.

Cost & Timeline Benchmarks

Audit Cost Ranges (USD, Security-only scope)

| Company Size | Type I | Type II | |-------------|--------|---------| | SMB (<200 employees) | $15,000 - $40,000 | $25,000 - $70,000 | | Midmarket (200-1,000) | $30,000 - $75,000 | $50,000 - $130,000 | | Enterprise (1,000+) | $60,000 - $150,000 | $100,000 - $275,000 |

Each additional Trust Service Criteria beyond Security adds approximately 15% to the base cost.

Time to Audit-Ready (weeks)

| Readiness Score | Type I | Type II | |----------------|--------|---------| | 0-25% | 16-26 weeks | 26-52 weeks | | 25-50% | 10-18 weeks | 16-30 weeks | | 50-75% | 6-12 weeks | 10-20 weeks | | 75-90% | 3-6 weeks | 6-12 weeks | | 90-100% | 1-3 weeks | 2-6 weeks |

Methodology

Readiness Scoring

Each control is scored from 0 (not implemented) to 100 (fully implemented and evidenced). The per-criteria score is a weighted average based on control weights. A criteria passes at 70% or above. Overall readiness is the weighted average across all 45 controls.

Gap Severity Classification

Severity is determined by the combination of implementation score and control weight:

| Score Range | Weight >= 4 | Weight < 4 | |-------------|-------------|------------| | 0-24% | Critical | High | | 25-49% | High | Medium | | 50-69% | Medium | Low | | 70-100% | Low | Low |

Remediation Effort

| Score Range | Effort | Meaning | |-------------|--------|---------| | 0-29% | High | Needs full implementation | | 30-59% | Medium | Partially implemented, needs significant work | | 60-100% | Low | Mostly implemented, needs documentation or refinement |

Further Reading

• For a comprehensive SOC 2 preparation walkthrough, see the SOC 2 Compliance Checklist on vCSO.ai
• To understand the full cybersecurity audit process beyond SOC 2, read Cybersecurity Audit: A Complete Guide
• For broader compliance program guidance, see Cybersecurity Compliance Services

License

MIT