Skip to content
ENExplore Calculators

SOC 2 Readiness Calculator

Assess SOC 2 readiness across the CC1–CC9 common criteria, your control matrix, the observation window and known exceptions.

About SOC 2 Readiness Calculator

SOC 2 is not a checklist against a fixed control count — you describe your own controls and the service auditor tests whether they meet the trust services criteria, which is why the control matrix is scored against your own total. Exceptions carry a direct penalty rather than being averaged away, because a single untreated exception changes the wording of the opinion, and the observation window is weighted separately since a Type 2 report needs elapsed time no amount of effort can shorten. Most SOC 2 programmes slip because the observation window starts before the controls actually operate, producing a report full of exceptions that customers then read. This is a readiness estimate; only a licensed CPA firm acting as service auditor can issue the report or the opinion.

Formula

SOC 2 Readiness

Readiness = 0.40 × CC1–CC9 coverage + 0.30 × controls operating effectively + 0.15 × additional category coverage + 0.15 × observation window completed, minus 3 points per known exception (capped at 30).

CC1–CC9
The nine common criteria categories that make up the security category
exceptions
Instances where a control did not operate as described during the window
windowNeed
Three months is the shortest Type 2 window most auditors will accept

Worked example

With the default values below, SOC 2 Readiness Calculator returns SOC 2 Readiness Score of 62.1%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Common criteria categories CC1–CC9 fully evidencedaccepts 0–9 categories
7 categories
Controls in the control matrixaccepts 1–400 controls
64 controls
Controls operating effectively with evidenceaccepts 0–400 controls
48 controls
Additional trust services categories in scopeone of Security only — 0, Security plus 1 category — 1, Security plus 2 categories — 2, Security plus 3 categories — 3, All five categories — 4
Security plus 2 categories — 2
Additional categories fully evidencedaccepts 0–4 categories
1 categories
Observation window completed so faraccepts 0–12 months
2 months
Report typeone of Type 1 — design at a point in time, Type 2 — design and operating effectiveness over a period
Type 2 — design and operating effectiveness over a period
Known control exceptions in the windowaccepts 0–100 exceptions
3 exceptions

Results

SOC 2 Readiness Score
62.1%
Common Criteria Coverage
77.8%
Controls Operating Effectively
75.0%
Controls Without Evidence
16 controls
Indicative Time to Audit
9 weeks
Report Scope
Security common criteria plus 2 additional category(ies) from availability, confidentiality, processing integrity and privacy
Opinion Risk
Exceptions will appear in the report alongside management's response, which is normal and survivable
Next Step
Run a readiness assessment first — the control matrix is not yet operating end to end

Step by step

  1. 1Values used
  2. 2SOC 2 Readiness
  3. 3SOC 2 Readiness Score= 62.1
  4. 4Common Criteria Coverage= 77.8
  5. 5Controls Operating Effectively= 75.0
  6. 6Controls Without Evidence= 16 controls
  7. 7Indicative Time to Audit= 9 weeks
  8. 8Report Scope= Security common criteria plus 2 additional category(ies) from availability, confidentiality, processing integrity and privacy

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is SOC 2 Readiness calculated?

Readiness = 0.40 × CC1–CC9 coverage + 0.30 × controls operating effectively + 0.15 × additional category coverage + 0.15 × observation window completed, minus 3 points per known exception (capped at 30). SOC 2 is not a checklist against a fixed control count — you describe your own controls and the service auditor tests whether they meet the trust services criteria, which is why the control matrix is scored against your own total. Exceptions carry a direct penalty rather than being averaged away, because a single untreated exception changes the wording of the opinion, and the observation window is weighted separately since a Type 2 report needs elapsed time no amount of effort can shorten.

Why does SOC 2 Readiness matter?

Most SOC 2 programmes slip because the observation window starts before the controls actually operate, producing a report full of exceptions that customers then read. This is a readiness estimate; only a licensed CPA firm acting as service auditor can issue the report or the opinion.

What values do I need to enter?

This calculator takes 8 inputs: Common criteria categories CC1–CC9 fully evidenced, Controls in the control matrix, Controls operating effectively with evidence, Additional trust services categories in scope, Additional categories fully evidenced, Observation window completed so far, Report type, Known control exceptions in the window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I start with Type 1 or Type 2?

Type 1 tests design at a point in time and can be issued quickly, which helps if a customer needs something now. Type 2 tests operating effectiveness across a window and is what enterprise procurement actually wants, so treat Type 1 as a bridge rather than a destination.

Do exceptions mean I failed?

No. Reports routinely contain exceptions with a management response, and buyers read the response as much as the exception. What damages a report is a pattern — several exceptions against the same criterion, or an exception that recurs in the next window after you said it was fixed.

Related Calculators

SOC 2 Readiness Calculator – Calculate SOC 2 Readiness Score