Getting SOC 2 ready is harder than most organizations expect — not because the controls are complicated, but because nobody tells you exactly what the auditor is going to look for. This checklist does. It covers all nine Security criteria in full depth, with specific evidence requirements for each item, plus guidance on when the four optional criteria are relevant to your organization.