Free, no sign-up to start: the plan opens as a live, editable Gantt chart. 13 tasks across 4 phases, about 29 weeks if every task runs in sequence.
What's in the template
| Phase | Task | Example duration |
|---|---|---|
| Scope | Choose trust services criteria | 3 days |
| Scope | Select audit firm | 10 days |
| Scope | Readiness assessment | 10 days |
| Build | Write security policies | 15 days |
| Build | Access reviews and onboarding controls | 10 days |
| Build | Change management controls | 10 days |
| Build | Vendor risk reviews | 10 days |
| Build | Set up evidence collection | 5 days |
| Type I | Type I audit fieldwork | 5 days |
| Type I | Type I report | 10 days |
| Type II | Observation window | 90 days |
| Type II | Type II audit fieldwork | 10 days |
| Type II | Type II report | 15 days |
Durations are examples to replace with your own estimates, not benchmarks.
About this soc 2 readiness plan
A SOC 2 report is an independent auditor's opinion on your controls. Most companies start with a readiness assessment, fix gaps, get a Type I report (controls designed properly at a point in time) and then a Type II report covering an observation period.
The observation window is usually the longest bar on the chart, which is why it helps to see it early. Your auditor agrees the period length with you.
Who it's for: Startup founders, security engineers and compliance leads preparing for a first SOC 2.
How to use it
- Open the plan. Click Open in the editor. The tasks load as a live Gantt chart without signing in.
- Match your auditor. Change the observation window to the period you agree with your audit firm.
- Assign owners. Add the owner's name to each control row, for example IT for access reviews.
- Share. Send a read-only link to the leadership team so everyone sees the report date.
Planning tips
- Start collecting evidence on day one of the observation window, not at the end.
- Security is the one trust services criterion every SOC 2 includes; add others only if customers need them.
- Some companies skip Type I and go straight to Type II; delete those rows if you do.
Frequently asked questions
- What is the difference between SOC 2 Type I and Type II?
- Type I covers control design at a point in time. Type II also tests that controls operated effectively over a period.
- How long is a SOC 2 observation window?
- It is agreed with your auditor, commonly somewhere between three and twelve months. This template uses about three months.
- Is it free?
- Yes. Opening and editing the template is free, and a free account saves one project. Downloading the chart as PDF or CSV needs Solo.
Related templates
The free plan saves one project. Downloads (PDF, CSV) and more projects are on Solo, $12/month.