SOC 2 Starter Bundle (Policies, Control Matrix, Risk & Vendor)

The SOC 2 foundations auditors test first: policies, controls and evidence, risk assessment and vendor management, with a 4-week plan. Bought separately these cost $237; the bundle is $199, a saving of $38.

What you get

1. SOC 2 Policy Templates Pack (Word and Excel, $129 on its own): 20 editable policies, a map to all 61 criteria with coverage check, and an approval, review and acknowledgement tracker.
2. SOC 2 Readiness Assessment & Control Matrix (Excel, $59 on its own): scope, 61 criteria, 148 controls, a readiness dashboard and a 111-item evidence request list.
3. SOC 2 Risk Assessment & Vendor Management Kit (Word and Excel, $49 on its own): risk and vendor procedures, a register with 47 example risks, vendor tiering with CUEC mapping, and a 62-question vendor questionnaire.
4. Bundle Start Here guide (PDF): how the pieces connect and a 4-week plan. 29 files in total.

Your first 4 weeks

1. Week 1, scope and baseline: complete the Scope sheet, make a first pass of the control matrix with owners and status, read policy 01 and replace names and tools across all policies.
2. Week 2, risk and vendors: run the risk workshop including fraud, build the vendor inventory, collect Critical vendor SOC reports and start CUEC mapping, adapt policies 02 to 10.
3. Week 3, policies and controls: adapt policies 11 to 20 with realistic numbers, update the matrix with gaps, dates and N/A decisions, and send the questionnaire to vendors without a SOC report.
4. Week 4, approve and plan: CEO approves policies and the risk assessment, launch staff acknowledgement, check coverage, assign evidence owners and agree the gap-closure plan.

Most teams then need several more weeks of control operation before a Type 1 date, depending on the size of the gaps.

Who it is for

Founders, first security hires and operations leads at SaaS companies of roughly 10 to 200 people who need to get SOC 2-ready without a large platform budget, or who use a platform and want stronger policies and a clearer view of their controls.

Good to know

• Instant download. Editable Word (.docx) and Excel (.xlsx), plus PDF guides. Works in Excel 2016 or later, Microsoft 365 and LibreOffice; no macros.
• Licensed for use within one organization.
• Criteria are referenced by number and summarized in our own words; the AICPA criteria are free to download from the AICPA.
• SOC 2 is an attestation report by a licensed CPA firm, not a certification. These templates help you prepare; they do not guarantee an unqualified SOC 2 opinion.
• 5-day fit guarantee: if it does not fit your system, contact us within 5 days of purchase.