What does a Singapore company need in place for SOC 2?
Short answer: a control environment that operates — not just a policy folder. SOC 2 examines your controls against the Trust Services Criteria you select (AICPA framework); Security is mandatory, the other four categories are optional. What the CPA firm tests is whether those controls were suitably designed and, for Type II, actually operated across the observation window.
We have compiled the practical work into an editable checklist:
Download the SOC 2 Compliance Checklist (CSV) — opens in Excel, Google Sheets or any spreadsheet tool. Each row carries a suggested owner, frequency and status column so you can run it as a live working document.
What the checklist covers
| Area | Examples |
|---|---|
| Governance & policy | Information security policy, defined roles, management review |
| Risk management | Risk assessment and treatment records |
| Access control | Unique accounts, MFA, least privilege, quarterly access reviews, joiner/leaver evidence |
| Change management | Documented, approved, tested changes; separation of duties |
| Incident response | IR plan, logged incidents, post-incident reviews |
| Vendor management | Vendor register, security due diligence, data processing agreements |
| Awareness & HR | Security training records, NDAs, lawful background checks |
| Asset & physical | Asset inventory and classification, physical access controls, media disposal |
| Availability (if selected) | Backups with restore tests, continuity plan exercises, monitoring |
| Confidentiality / Privacy (if selected) | Encryption at rest and in transit, retention and disposal schedule |
| Evidence discipline | The evidence register itself — the backbone of the observation window |
How to use the checklist
- Assign an owner for every row before anything else. Controls without named owners are the first thing to lapse mid-window.
- Set the frequency honestly. If quarterly access reviews will actually happen monthly, record monthly — the evidence must match the stated cadence.
- Record evidence as it is produced. A screenshot taken at audit time is worth far less than a dated record produced when the control ran.
- Track status visibly. Not started / In progress / Operating — and review the report in management review meetings.
- Do not gold-plate the scope. Only the criteria your buyers and contracts justify should be in scope; every added category widens the evidence burden.
Checklist to examination: the readiness step
A checklist gets your control environment into shape; a SOC 2 readiness assessment converts it into an examination plan — gap classification, remediation actions with target dates, evidence templates, and a mock CPA-style review before fieldwork.
If you are deciding between Type I and Type II first, read SOC 2 Type I vs Type II. For the full engagement — scoping, control documentation, evidence and CPA coordination — see SOC 2 compliance and consultancy in Singapore.
Next step: download the checklist, or request a SOC 2 readiness assessment and ICPL will benchmark your current controls against the criteria with you.
The checklist is a preparation aid, not a substitute for a readiness assessment or the CPA firm's examination.