SOC 2 and HIPAA readiness checklist

SOC 2

Decide the scope: which services, which criteria (Security is required), Type I or Type II.
Name an owner and an executive sponsor.
Write the core policies: information security, access control, change management, incident response, vendors, continuity, retention, acceptable use.
Run a risk assessment and keep a risk register with owners.
Access: multi-factor, least privilege, regular reviews, leavers removed promptly.
Changes are reviewed, approved and recorded.
Logs are kept and alerts are reviewed.
List your vendors and assess the critical ones.
Have an incident plan, test it yearly, review every incident.
Back up, test restores, and set recovery targets.
Training at hire and yearly; policies acknowledged.
Decide where evidence comes from and collect it through the whole audit period.
Pick an auditor and hold a readiness review first.

Confirm whether you are a covered entity or a business associate.
Sign business associate agreements with every associate.
Appoint a security official and a privacy official.
Complete and document a risk analysis; keep it current.
Keep a risk management plan with owners and dates.
Train the workforce; have a sanctions policy.
Access: unique user IDs, emergency access procedure, automatic logoff, encryption where reasonable.
Record and review activity in systems that hold health information.
Contingency plan: backups, disaster recovery, emergency operation.
Write a breach notification procedure.
Privacy: notice of privacy practices, minimum necessary, patient rights procedures.
Keep documentation for six years.

General guidance, not legal or audit advice. Print it with Ctrl+P.