What is the difference between a gap assessment and a readiness assessment?

The terms are often used interchangeably. Both compare what you have today with what the Trust Services Criteria in your scope ask for, before the audit. A gap assessment usually means the criterion-by-criterion worksheet with a status, owner and fix per row; a readiness assessment can also mean a consultant's review of your evidence. This template is the worksheet; the free readiness check is a faster first pass you can feed into it.

How long does a SOC 2 gap assessment take?

It depends on how much already exists and how many people own controls. Going through the rows with each owner, rather than filling the sheet alone, takes longer but produces statuses you can trust. Plan to repeat it before the audit period starts, because the fixes change the picture.

Is a pre-filled status from the readiness check reliable?

It is a starting point. The readiness check asks 20 questions, several criteria share a question, and some criteria are not touched by any question, so those rows stay blank. Treat every pre-filled status as a claim to confirm against evidence: if you cannot point at the record, the control is not in place yet.

Do I need a gap assessment before a SOC 2 Type I?

Nothing requires one, but it is the cheapest way to avoid surprises. A Type I report looks at the design of your controls at a single date, so the gaps that matter most are missing policies, missing owners and controls that exist only on paper. The worksheet makes those visible while there is still time to fix them.

SOC 2 gap assessment template

A free Excel worksheet with one row for each of the 38 Trust Services criteria this site maps: what each asks, the policies and evidence behind it, and columns for status, owner, evidence location and the fix. If you take the readiness check first, its answers pre-fill the status column. No email, no signup.

What a SOC 2 gap assessment is

A gap assessment compares the controls you run today with what the criteria in your report scope ask for, and turns the difference into a list of fixes with owners and dates. It is the step between deciding to get a SOC 2 report and booking the audit, and it is a self-assessment: the CPA firm decides in the examination whether your controls meet the criteria.

Working criterion by criterion keeps the assessment honest. It stops the common pattern of checking the areas you already know well and skipping the ones nobody owns, such as monitoring activities (CC4) or vendor risk (CC9.2).

How to run one with this worksheet

Set the scope. The common criteria apply to every report. Delete the Availability (A1) and Confidentiality (C1) rows if those categories are not in your scope.
Go through the rows with the people who run the controls. Read what the criterion asks, then ask the owner what happens today and where the record is.
Set a status only you can defend. In place means documented, operating and evidenced. Anything you cannot point at is Partial or Not started.
Write the fix and a date. Most fixes are a policy, an owner and a recurring task that leaves a record. The policies column tells you which document covers it.
Re-run it before the period starts. For a Type II report, controls have to operate through the whole period, so close the gaps first.

What is in the workbook

Four sheets: instructions, the gap assessment itself, a summary that counts statuses by series with live formulas, and (when you came from the readiness check) your twenty answers with the suggested fix for each.

Column	What it holds
Criterion, series, category, title	Which Trust Services criterion the row is about, linked to the same ids the auditor uses.
What it asks	A plain-English paraphrase of the criterion, in our own words.
Policies	The Policyseed policies that document a control for this criterion.
Evidence examples	Records a small SaaS company can usually produce for it.
Readiness check questions	The readiness check questions that touch the criterion, with your answer if you came from the check.
Status	Not started, Partial, In place or Not applicable. Pre-filled from the readiness check when you came from it; otherwise yours to set.
Owner, evidence location	Who runs the control and where its evidence lives.
Gaps and remediation, target date	What is missing and the fix, pre-filled with the readiness check's suggestion for any no or partly answer.

Starting from the readiness check

The SOC 2 readiness check asks 20 yes, partly or no questions, and each one maps to the criteria it evidences. Together they touch 27 of the 38 criteria. When you open this page from the check’s results, the worksheet uses your answers: where several questions touch one criterion, the least favorable answer sets the status, and criteria no question touches stay blank for you to assess. Your answers travel in the page address after the # sign, which browsers do not send to servers.

Series	Criteria	Readiness questions that touch it
CC1 Control environment	CC1.1, CC1.2, CC1.3, CC1.4, CC1.5	Do you have written security policies that management approved in the last 12 months? Is one named person accountable for the security program? Does everyone acknowledge the security policies and complete security training at hire and every year? Do you follow a written onboarding and offboarding checklist, including background checks where lawful?
CC2 Communication and information	CC2.1, CC2.2, CC2.3	Does everyone acknowledge the security policies and complete security training at hire and every year?
CC3 Risk assessment	CC3.1, CC3.2, CC3.3, CC3.4	Have you completed a documented risk assessment, with a scored risk register, in the last 12 months?
CC4 Monitoring activities	CC4.1, CC4.2	Do you check at least yearly that your controls are still working, and track the fixes?
CC5 Control activities	CC5.1, CC5.2, CC5.3	Do you have written security policies that management approved in the last 12 months?
CC6 Logical and physical access controls	CC6.1, CC6.2, CC6.3, CC6.4, CC6.5, CC6.6, CC6.7, CC6.8	Is multi-factor authentication enforced for everyone on your identity provider, cloud console and source control? Is access granted through single sign-on groups or roles, following least privilege? Do you review who has access to production, source code and admin roles at least quarterly, and keep the record? When someone leaves, is their access removed within a defined time you can prove? Are laptops encrypted, screen-locked and kept up to date, and can you prove it (device management or attestation)? Is customer data classified, encrypted in transit and at rest, and deleted on a defined schedule?
CC7 System operations	CC7.1, CC7.2, CC7.3, CC7.4, CC7.5	Do you scan code, dependencies and infrastructure for vulnerabilities and fix findings within set timelines? Are security-relevant logs collected centrally, retained, and alerted on? Do you have a written incident response plan that you tested (for example a tabletop) in the last 12 months?
CC8 Change management	CC8.1	Does every production change go through a pull request with an independent review and passing checks? Are production deployments done only through your CI/CD pipeline, not by hand?
CC9 Risk mitigation	CC9.1, CC9.2	Do you keep a vendor inventory and review the SOC 2 reports of vendors that hold customer data? Do you have a business continuity and disaster recovery plan with recovery time and recovery point objectives?
A1 Availability	A1.1, A1.2, A1.3	Are backups automated, and have you restored from one as a test in the last 12 months? Do you have a business continuity and disaster recovery plan with recovery time and recovery point objectives?
C1 Confidentiality	C1.1, C1.2	Is customer data classified, encrypted in transit and at rest, and deleted on a defined schedule?

After the assessment

Missing policies: the free generator writes all 22 around your tools, and the SOC 2 policies list shows which criteria each one addresses.
Missing evidence: the SOC 2 evidence checklist lists what to collect per criterion.
Missing records: the risk register and access review templates cover two records auditors usually ask for early.
The report itself: the system description template drafts the description management writes for the report.

Frequently asked questions

What is the difference between a gap assessment and a readiness assessment?: The terms are often used interchangeably. Both compare what you have today with what the Trust Services Criteria in your scope ask for, before the audit. A gap assessment usually means the criterion-by-criterion worksheet with a status, owner and fix per row; a readiness assessment can also mean a consultant's review of your evidence. This template is the worksheet; the free readiness check is a faster first pass you can feed into it.
How long does a SOC 2 gap assessment take?: It depends on how much already exists and how many people own controls. Going through the rows with each owner, rather than filling the sheet alone, takes longer but produces statuses you can trust. Plan to repeat it before the audit period starts, because the fixes change the picture.
Is a pre-filled status from the readiness check reliable?: It is a starting point. The readiness check asks 20 questions, several criteria share a question, and some criteria are not touched by any question, so those rows stay blank. Treat every pre-filled status as a claim to confirm against evidence: if you cannot point at the record, the control is not in place yet.
Do I need a gap assessment before a SOC 2 Type I?: Nothing requires one, but it is the cheapest way to avoid surprises. A Type I report looks at the design of your controls at a single date, so the gaps that matter most are missing policies, missing owners and controls that exist only on paper. The worksheet makes those visible while there is still time to fix them.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.