Audit objective and quick orientation

• How many people on your team have directly managed a SOC 2 Type II audit before? Options: None, 1 person, 2-3 people, More than 3
• Describe your primary business driver for pursuing a SOC 2 Type II right now, for example to close a specific deal or to meet a buyer requirement
• Which outcome would unblock the six-figure prospect most quickly Options: A delivered SOC 2 Type II report, Auditor readiness confirmation, Proof of continuous evidence collection, Vendor contract clause satisfied, Other
• Who on your leadership team will need to sign off on the audit delivery and budget Options: Head of Security/VP Security, VP Engineering/CTO, CFO, CEO, Procurement
• When does your top prospect expect an audit report by Options: Within 2 weeks, Within 4 weeks, Within 6-8 weeks, More than 8 weeks, No fixed date
• If you cannot produce a Type II report within your target window, what is the concrete commercial consequence for the deal

How your controls show up day to day

• What's the single control area that, if an auditor spot-checked it and failed, would force you to delay the audit Options: Access management, Change control and deployments, Logging and monitoring, HR onboarding and termination, Configuration management, Other
• List the environments you expect us to sweep during evaluation, choose all that apply Options: Cloud infrastructure, Identity and access provider, Source code hosting and CI, HR and payroll systems, Ticketing and change systems, Other
• Which concrete evidence artifacts do you already produce regularly for controls, for example access logs, pull request reviews, or org charts Options: Access logs, Audit trails from identity provider, Code review records, Onboarding/offboarding records, Policy docs in wiki, None of the above
• Who currently owns the evidence collection for each environment and are they available to grant access Options: Security team, Platform/Infra team, Dev team leads, People Operations, No clear owner
• Where is your control evidence stored today and how quickly could you grant read access to it for automated collection Options: Centralized cloud storage, within days, Internal wiki, within days, Scattered across systems, needs consolidation, Stored offline, hard to access, We do not have central storage

Who will run this and who needs convincing

• Who will be responsible for closing evidence gaps week to week and do they have marked capacity to do that work
• Estimate the weekly engineering hours you can allocate to remediation during an audit preparation period Options: Less than 5 hours, 5 to 10 hours, 10 to 20 hours, 20 to 40 hours, More than 40 hours
• Which teams must sign off on connector credentials, choose all that apply Options: Security, Platform/Infrastructure, Dev teams, People Operations, Legal, Other
• If the remediation work requires a dedicated engineer for 6 weeks can your team assign one Options: Yes, assigned, Yes, can assign, No, not available, Unsure
• Who has final authority to pause the project if remediation draws on critical release windows Options: Head of Security/VP Security, VP Engineering/CTO, Product/Eng leadership, CEO, Other

The timeline procurement will believe

• If an auditor gave you a four to eight week window for readiness what internal milestone would you need to meet in week two to stay on track Options: Core connectors enabled, Preliminary readiness score ≥50%, Critical evidence sources validated, Remediation owners assigned, Other
• What target readiness score would you accept from the trial to justify moving to subscription Options: 40%, 50%, 60%, 70%, 80%+
• Which audit acceptance criteria beyond the readiness score matter to procurement, for example continuity of evidence or auditor provisional availability Options: Continuous evidence collection, Auditor engagement scheduled, Documentation completeness, No outstanding high-risk findings, Other
• When is your company's budget cycle and who must be in the approval path for an annual subscription Options: Currently in cycle, decision this month, Next cycle in 1-3 months, Next cycle in 3-6 months, Ad hoc approval
• If the trial produces your target readiness within a week who is enabled to greenlight the purchase immediately Options: Head of Security/VP Security, VP Engineering/CTO, CFO, Procurement lead, Other

What usually derails projects like this

• Which single integration or internal dependency has derailed previous security projects or audits here Options: Identity provider access, Cloud logging access, Source code access, HR system data, Legal or data residency issues, Other
• Do you have any outstanding incidents open or remediation tasks that would affect timelines Options: Yes, active incidents, Yes, scheduled remediation, No, Unsure
• Which legal or compliance approvals must be obtained before we can enable integrations, choose all that apply Options: Data export approval, Third-party vendor approval, Security review, Privacy office sign-off, None required
• How often do infrastructure or identity changes occur that could invalidate collected evidence during the audit window Options: Weekly, Monthly, Quarterly, Rarely
• Which single gating issue would stop this engagement from starting if unresolved within two weeks Options: No API access to critical system, No budget approval, Legal restriction on data sharing, No assigned remediation owner, Other

Other routes you are actively weighing

• Why would you keep using spreadsheets or an internal checklist instead of a platform that automates evidence collection and auditor coordination
• Which alternative approaches are you currently evaluating, select all that apply Options: Do it internally with current staff, Hire a consulting firm for readiness, Subscription platform for evidence only, Auditor-run readiness assessment, Other
• What would have to be true about your current approach for you to keep it rather than change
• Has anyone on your team proposed solving this without an outside vendor and if so who and what plan did they propose Options: Yes, engineering proposed internal plan, Yes, security proposed internal plan, No internal proposal, Unsure
• If your preferred alternative is an internal effort when would that team be ready to deliver a Type II report compared to vendor-assisted timelines Options: Within 4 weeks, 4-8 weeks, 8-16 weeks, More than 16 weeks, Unknown

Practical blockers we must clear before we connect

• Which of your environments cannot provide the API or read-only access required for automated evidence collection within seven days Options: Cloud infrastructure, Identity provider, Source code hosting, HR system, None, all available, Unsure
• List the exact systems we will need to connect for a representative trial, choose all that apply Options: Primary cloud account, Identity provider tenant, Main repo or code host, HR/payroll system, Ticketing/change system, Other
• Who controls those credentials and what is the typical lead time to provision them Options: Platform/Infra team, days, Security team, days, Dev team, weeks, People Ops, weeks, No clear owner
• Are there contractual or regulatory constraints that prevent exporting logs or access records to a third party Options: Yes, No, Partial restrictions, Unsure
• If any of the required systems cannot be connected within seven days will you pause the trial or proceed with a reduced scope Options: Pause trial until access available, Proceed with reduced scope, Proceed with manual evidence only, Decide after review

How the trial will demonstrate value

• If you run the one-week trial and the platform surfaces 50 or more gaps what decision path will you follow Options: Accept gaps and budget remediation, Delay audit and remediate, Engage consultants for fixes, Re-evaluate solution choice
• Which environments will you prioritize for the trial to produce the most meaningful readiness signal Options: Cloud infrastructure, Identity provider, Source code and CI, HR system, Combination
• Who will be responsible for connecting systems during the trial and scheduling the auditor review Options: Platform/Infra engineer, Security engineer, Dev team lead, External consultant, Other
• What specific metric from the trial will your procurement or security leadership require to approve moving to subscription Options: Readiness score threshold, Percentage of auto-populated controls, Evidence coverage percentage, Auditor provisional sign-off, Other
• If the trial meets your approval criteria what internal steps remain before procurement will sign the contract Options: Budget sign-off, Legal review, Vendor security review, Final stakeholder demo, Other

Decision levers and next steps

• What single quantitative result from the trial would cause procurement to sign this quarter Options: Readiness score ≥70%, Evidence coverage ≥80%, No high-risk findings, Auditor provisional sign-off, Other
• Who is the budget owner and who will negotiate terms with legal and procurement Options: CFO and Legal, Head of Security and Legal, VP Engineering and Procurement, Other
• Which contract terms are non-negotiable for you choose all that apply Options: Annual term, SLA uptime, Data residency, Auditor access, Cancellation terms, Other
• When would you like to schedule the one-week trial to align with your release and hiring calendar Options: Immediately, Within 2 weeks, 2-4 weeks, 1-3 months, Unsure
• If the pilot proves the agreed metrics who signs to convert the account to a paid subscription and on what timeline Options: Head of Security within 7 days, VP Engineering within 7 days, CFO within 14 days, Procurement within 14 days, Other

• Connect cloud infrastructure for evidence collection
• Connect version-control repositories for activity logs
• Connect identity provider for access evidence
• Connect HRIS for personnel and onboarding records
• Continuous automated evidence ingestion
• Auto-populate controls with collected evidence
• Manual evidence upload, tagging, and versioning
• Generate auditor-ready evidence package
• Provide auditor coordination and package delivery
• Prebuilt remediation task templates and checklists
• Control drift monitoring and real-time alerts
• Immutable evidence retention and audit trail
• Provide policy and procedure template library

Connect cloud infrastructure for evidence collection

• Which cloud providers should we connect for evidence collection (select all that apply)? Options: AWS, GCP, Other
• How many cloud accounts or projects must be swept for evidence (count of AWS accounts or GCP projects)? Options: 1-3, 4-10, 10+
• List the specific audit log sources to include (examples: AWS CloudTrail, VPC flow logs, GCP Audit Logs, KMS usage logs).
• Specify the object storage buckets or prefixes containing logs/config source artifacts we must access (provide bucket names or GCP storage paths).
• Who will create or approve the read-only IAM role or service account for evidence collection and what is their email or Slack handle?
• What retention period do you require for collected cloud logs to satisfy auditor sampling (e.g., 90 days)? Options: 30 days, 60 days, 90 days, Custom

Connect version-control repositories for activity logs

• Which source control platforms host the repositories we should connect (provide the platform names used by your engineering teams)? Options: Git-based hosted repos, Self-hosted Git, Other
• How many repositories and active branches should be included in the sweep (enter a best estimate)? Options: Fewer than 10, 10-50, 50-200, More than 200
• List any protected branches, required PR reviewers, or branch protection rules that must be captured for control evidence.
• Specify whether commit history, merge timestamps, CI/CD run metadata, and code review comments are required as evidence (select all that apply). Options: Commit history, Merge/PR timestamps, CI/CD run artifacts, Code review comments, Not all required
• Who will generate or approve the repository-level deploy key or OAuth app we need to read activity logs and what is their contact?
• Do you have any monorepos or internal package registries whose access patterns must be included in the scope? Options: Yes, No

Connect identity provider for access evidence

• Which identity provider(s) must be integrated to collect access and provisioning evidence (provide the IdP type or tenant name used internally)? Options: SAML/OIDC provider, SCIM-enabled provisioning, Other
• How many user accounts, groups, or service principals are in scope for access evidence? Options: Under 100, 100-500, 500+
• List the system events from the IdP you need captured (examples: logins, failed logins, provisioning/deprovisioning events, MFA changes).
• Specify the minimum historical window of identity events required for the auditor (e.g., 30 days, 90 days). Options: 30 days, 60 days, 90 days, Custom
• Who is the designated owner for identity connector approval and creation of API client credentials?
• Are there delegated identity providers (federated IdPs) or SSO partners whose logs must be included? Options: Yes, No

Connect HRIS for personnel and onboarding records

• Which HR systems contain the personnel and onboarding records we must ingest (provide the HRIS type or indicate 'Other')? Options: Cloud HRIS, Spreadsheet/CSV, Other
• How many employee records, contractors, and terminated accounts are in scope for evidence collection? Options: Under 50, 50-250, 250+
• List the HR artifacts required for controls (examples: offer letters, signed NDAs, role start dates, termination records, org chart).
• Specify whether onboarding checklists, access approval forms, and background check results must be included. Options: Onboarding checklists, Access approvals, Background checks, None of the above
• Who will provide read access to the HRIS or export the personnel records and what is their contact?
• Do you require masking or redaction of sensitive HR fields before we ingest records (examples: SSNs, personal addresses)? Options: Yes, No

Continuous automated evidence ingestion

• What in-scope sources must have continuous ingestion enabled from day one (select all that apply)? Options: Cloud logs, Identity events, VCS activity, HR records
• Provide the target cadence for evidence collection and sync (examples: real-time streaming, hourly batch, daily batch). Options: Real-time / streaming, Hourly, Daily, Custom
• What operational threshold will indicate successful continuous ingestion (examples: >95% daily log arrival, no gaps older than 24 hours)?
• Who will receive automated ingestion alerts and what escalation channel should be used (email, Slack, other)? Options: Email, Slack, PagerDuty, Other
• What evidence will validate continuous automated ingestion is operating for the in-scope cloud and identity sources (examples: daily log counts, last 7-day ingest timestamps)?
• Are there data residency or cross-region restrictions that will limit which logs we can export or store? Options: Yes, No

Auto-populate controls with collected evidence

• Which Trust Services Criteria or control families are highest priority for auto-population (examples: change management, access control, system operations)? Options: Access control, Change management, System operations, Other
• How many controls do you expect to have auto-populated from connectors versus manual evidence? Options: Fewer than 20%, 20-60%, More than 60%
• List any custom controls or nonstandard evidence mappings we must accommodate for auto-population.
• Who will confirm mappings between collected artifacts (for example CloudTrail events) and specific control statements?
• Specify whether you require audit-ready labels and timestamps on auto-populated control evidence for SOC 2 Type II sampling. Options: Yes, No
• Are there legacy processes or spreadsheets we should pull into the control mapping to preserve historical context? Options: Yes, No

Manual evidence upload, tagging, and versioning

• What document types will you upload manually for controls (examples: policies, signed attestations, runbooks)?
• How should uploaded evidence be tagged to map to control IDs or control families? Options: Control ID, Control family, Custom tags, No tagging needed
• Specify whether you need versioning for manual uploads and how many historical versions to retain. Options: No versioning, Keep last 3 versions, Full history
• Who on your team will be authorized to upload and approve manual evidence submissions?
• Do you require an approval workflow (for example manager sign-off) before manual evidence is promoted to auditor-ready? Options: Yes, No
• Are there file size, format, or encryption requirements for manual evidence ingestion (examples: PDF only, encrypted ZIP)?

Generate auditor-ready evidence package

• What acceptance criteria will confirm the auditor-ready evidence package meets SOC 2 Type II sampling and evidence labeling requirements (examples: 30 days of continuous logs, signed policy docs, linkable change records)?
• Which file formats and packaging conventions do your auditors expect for evidence delivery (examples: indexed PDFs, CSV manifest, JSON metadata)? Options: Indexed PDF, CSV manifest, JSON metadata, Other
• How frequently do you want a snapshot evidence bundle generated for auditor review (examples: weekly, on-demand, at milestone)? Options: Weekly, On-demand, At milestone only
• List any control-specific export requirements your auditor has requested (examples: system change logs with user IDs, 2FA proof for privileged accounts).
• Who on your side will be responsible for reviewing and approving the packaged evidence before we hand it to the auditor?
• Do you require signed attestations or notarized documents included in the package for any controls? Options: Yes, No

Provide auditor coordination and package delivery

• Which auditor engagement model do you prefer for coordination included in the subscription (examples: we coordinate scheduling, you use your auditor, we introduce our vetted auditor)? Options: You will use your auditor, We introduce vetted auditor(s), We coordinate with auditor you nominate
• What preferred delivery channel should we use to transmit evidence packages to the auditor (examples: secure share, SFTP, auditor portal)? Options: Secure file share, SFTP, Auditor portal, Other
• Who is the primary auditor contact and what is their role (if already engaged)?
• Provide the target audit window or desired audit start date and any hard deadlines the auditor must respect.
• What level of coordination do you expect us to perform (examples: scheduling evidence reviews, answering auditor questions, providing supplemental exports)? Options: Scheduling only, Scheduling and Q&A support, Full package delivery and liaison
• Are there auditor sample size or population constraints we must honor for Type II testing (for example, minimum 30 days continuous telemetry)? Options: Yes, No

Prebuilt remediation task templates and checklists

• Which control areas should include prebuilt remediation templates (examples: access revocation, patch management, change approvals)? Options: Access revocation, Patch management, Change approvals, Other
• How many remediation tasks per control do you want prepopulated (examples: 1-3 standard runbooks per control)? Options: 1-2, 3-5, 5+
• List the team roles who will act on remediation items and whether they need templated playbooks attached to tasks.
• Specify whether automated remediation (for example scripted IAM revocation) is permitted or only manual tasks should be created. Options: Automated remediation allowed, Manual tasks only
• Who will own configuring SLAs and due dates on remediation tasks (examples: security lead, VP engineering)?
• Do you expect remediation implementation to be in-scope for the subscription or treated as out-of-scope guidance work? Options: In-scope implementation, Out-of-scope; guidance only

• desired_state
• current_state
• stakeholders
• gaps
• success_criteria
• decision_readiness
• desired_state
• decision_readiness
• current_state
• success_criteria
• gaps
• stakeholders
• desired_state
• success_criteria
• stakeholders
• gaps
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Subscription Agreement
• Audit Coordination Addendum
• Acceptance Criteria & Readiness Sign-off
• Mutual Responsibilities & Access Authorization
• Payment & Billing Terms
• Data Processing Agreement (DPA)
• Service Level & Support Agreement (SLA)
• Termination & Audit Transition Policy

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate Review (around day 90)
• Quarterly Success Review (ongoing)

• Log and prioritize enhancement requests in the shared channel and schedule periodic review for backlog grooming.
• Record a formal acceptance decision in the workspace for each criterion documented in Mutual Commit.
• For any non-passing criteria, capture a remediation plan with dates to reach acceptance.
• Confirm the evidence package delivery to the auditor and how auditor feedback will be tracked post-acceptance.
• Update the journey workspace with the acceptance decision and link the final evidence package delivered to the auditor.
• Create and publish remediation timelines for any conditional or failed criteria with explicit verification steps.
• Schedule a short follow-up evidence validation check with the auditor if any conditional items remain open.
• Quarterly metric review
• Ensure readiness score and open remediation item trends remain at or improve toward the targets recorded in Mutual Commit.
• Close or reprioritize persistent remediation items and confirm next-quarter owners and dates.
• Maintain a single shared channel for enhancement requests and assign priority for implementation or deferral.
• Produce a quarterly remediation plan with priorities and target close dates for all items remaining open at review end.
• Publish a summary of auditor feedback trends and recommended preventive actions in the shared workspace.
• Re-confirm success criteria and owners
• Confirm all scoped connectors are live and evidence ingestion is active for the primary environments.
• Identify and assign owners for any deployment blockers preventing evidence collection.
• Agree a date for the first measurement meeting within the 4-10 week window.
• Resolve connector authentication failures and validate end-to-end evidence ingestion within 5 business days.
• Provide updated access inventory listing environment owners and credential holders in the shared workspace.
• Schedule a live evidence review with the assigned auditor contact if evidence gaps persist after fixes.
• Present first measurement data
• Determine whether the readiness score and open remediation item count are moving toward the targets recorded in Mutual Commit.
• Agree a prioritized remediation plan for the top 3 blockers with committed resolution dates.
• Confirm the timeline to the acceptance gate and any dependencies on auditor review cycles.
• Create remediation tasks for the top 3 control gaps with target completion dates in the shared tracker.
• Enable automation for any manual evidence items that can be auto-collected within two sprints.
• Log all auditor feedback items in the shared channel and tag them for action and owner assignment.
• Restate acceptance criteria
• Deployment and connector validation
• Present outcome data vs targets
• Auditor feedback and evidence health
• Diagnose root causes for gaps
• Remediation burn-down and backlog
• Agree corrective actions and timelines
• Early adoption and usage signals
• Document pass or conditional pass per criterion
• Confirm auditor feedback channel and expectations
• Agree remediation closure plan for any conditional items
• Enhancement requests and shared channel review
• Open issues and blockers
• Immediate remediation and next steps