SOC 2 policy checker

How the coverage check works

This is a heuristic text match, not an audit opinion. It looks for the words and phrases auditors expect to see for each criterion. A match does not mean the control is designed well or operating, and a miss can mean only that your documents use different words. Your CPA firm decides what meets the criteria.

• Criteria. The 33 Security criteria (CC1 to CC9) are always checked; add Availability, Confidentiality, Processing Integrity or Privacy to match the scope of your report. Security, Availability and Confidentiality come from the Policyseed criteria crosswalk, which maps each criterion to the policy sections that address it.
• Signals. Each criterion has a short list of signals, the ideas an auditor looks for (for CC6.1: multi-factor authentication, least privilege, unique accounts, encryption, password rules and network restrictions). The 183 signals carry 909 alternative phrasings, drawn from the Policyseed policy text mapped to each criterion; a test keeps every one of them present in those policies.
• Matching. Words are compared after removing endings, so “approved” matches “approval” and “scanning” matches “scan”. A phrase matches when its words appear close together in one paragraph or list item, in any order.
• Status. A criterion is found when at least half its signals (and at least two) appear, weak when one or more appear, and not found when none do.
• Evidence. For each criterion with a match, the checker ranks the paragraphs of your text with BM25, the same keyword ranking the questionnaire tool uses, and shows the best one or two so you can judge the match yourself.

What the wording check flags

Policies should say what is required. Sentences that state results as facts, promise outcomes or were never finished become things the auditor tests or questions. The checker flags:

• States that everyone has already done something (high). A policy that says everyone has completed something is a factual claim. The auditor samples people from the whole period, and one person who had not finished is an exception against your own words.
• Claims compliance or certification (high). SOC 2 is an attestation report from a CPA firm, not a certification, and no document can make a company compliant. Auditors and customers treat these words as a misstatement, and they can create contractual or marketing liability.
• Uses the word guarantee (high). A guarantee is a promise of outcome. In a policy it reads as a commitment the company cannot keep, and customers may quote it back in a dispute.
• Absolute claim about the past or about uptime (medium or low). "Never" and "always" statements about what has happened are testable and usually unprovable. One ticket, alert or outage in the period contradicts the document.
• 100% or a precise uptime figure (medium or low). A percentage is a measurable commitment. The auditor can ask for the data behind it, and an uptime figure in a policy can conflict with the SLA in your contracts.
• Real-time or continuous monitoring claim (medium or low). "Real-time" and "continuous" monitoring imply someone or something watches every event as it happens. The auditor will ask for the alert rules, who receives them and how fast they respond, including nights and weekends.
• Blanket encryption claim (medium or low). "All data is encrypted" covers every store, backup, log, laptop and export. The auditor tests a sample, and one unencrypted bucket, log or spreadsheet makes the statement false.
• Zero-incident or zero-downtime claim (medium or low). "Zero" is an outcome no control can promise. It invites the auditor to look for the one event that disproves it.
• Response time measured in minutes (medium or low). Timelines in minutes are tested like any other requirement. A small team without a staffed on-call rotation rarely meets them for every event, nights and weekends included, and each miss is an exception.
• Placeholder or unfinished text (high). Placeholders show the document was never finished or approved. An auditor reading "[Fill in: owner]" or "TBD" will question whether the policy is in force at all.
• Another company’s name (high for well-known sample names, medium otherwise). Enter your company name and the checker lists other legal entity names, ignoring common vendors, and tells you if your own name never appears.
• No version, approval or review information (medium or low). Each document is checked for a version number, a date, an approver and a review cadence.

Each finding shows the sentence it came from, why it matters and a pattern for rewriting it. Requirement wording such as “must”, “at least annually” or “shared accounts are never used” is not flagged.

The 22 documents it compares against

A policy counts as present when a document’s file name, title or a heading matches its name or one of 118 common alternatives (“BCP”, “change control”, “vendor management”). When the subject only appears inside another document, it is marked as mentioned but without a document of its own.

• Information Security Policy
• Acceptable Use Policy
• Access Control Policy
• Authentication and Password Policy
• Asset Management Policy
• Data Classification and Handling Policy
• Data Retention and Disposal Policy
• Encryption and Key Management Policy
• Change Management Policy
• Secure Software Development Policy
• Vulnerability and Patch Management Policy
• Logging and Monitoring Policy
• Incident Response Policy
• Business Continuity and Disaster Recovery Policy
• Backup and Recovery Policy
• Vendor and Third-Party Risk Management Policy
• Risk Assessment and Management Policy
• Human Resources Security Policy
• Endpoint and Workstation Security Policy
• Network and Infrastructure Security Policy
• Physical and Remote Work Security Policy
• Privacy and Data Protection Policy

What this check cannot tell you

• Whether the controls you describe actually run. That is what the evidence and the auditor’s testing are for.
• Whether a requirement is right for your company. A matched phrase can sit in a sentence that says the opposite.
• Anything about documents you did not include. If your incident response plan lives in a wiki, paste it in too, or the incident criteria will show as gaps.

For a question-by-question view of where you stand, try the readiness check; for a criterion-by-criterion worksheet with owners, the gap assessment template.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.