← All courses
$20

SOC 2 Readiness

Run your own SOC 2 readiness and walk into the audit prepared. Understand what SOC 2 really is, scope it, implement the common controls, collect evidence that holds across the window, close your gaps, and pass the audit — then keep it. For founders, security/compliance leads, and engineers at B2B software companies.

"We're scoped to Security + Availability, we've mapped our controls, and here's our gap-closed readiness plan for a Type II audit"

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

  1. 1

    What a SOC 2 report is

    SOC 2 is a report written by an independent auditor about your security controls. You do not pass it once and keep it forever.

  2. 2

    Decide what the audit covers

    The audit should cover the systems that deliver your service to customers: wide enough that customers trust it, small enough that you can finish it.

  3. 3

    Controls: from written rule to real work

    SOC 2 controls are not hundreds of unrelated tasks. They fall into a few families, most companies run a similar set, and a written policy only counts once someone actually carries it out.

  4. 4

    Evidence: proof that a control ran

    Evidence is proof that a control actually ran. For a Type II report it has to hold up across the whole period, not just in one screenshot taken the night before.

  5. 5

    Find your gaps before the auditor does

    A gap assessment is a practice audit you run yourself before the real one. You rate each control as in place, partial or missing, and turn the gaps into a plan.

  6. 6

    The audit, and keeping it going

    SOC 2 is an ongoing program. You get a report for one period, then keep the controls running so the next report is clean too.

Skills you'll practise

Trust Services CriteriaType I vs Type IIControl MappingEvidence CollectionGap AssessmentContinuous Compliance

Practice data included

  • Trust Services Criteria (5)
  • Control baseline by family
  • Evidence examples (weak vs strong)
  • Gap self-assessment checklist (20 controls)

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

  • You answer 6 short questions, one for each module, in your own words (at least 40 words each).
  • An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
  • To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

  1. Module 1, What SOC 2 Actually Is: A correct mental model: report not certificate, Trust Services Criteria, Type I vs II, which criteria apply.
  2. Module 2, Scope Your SOC 2: A defined system boundary: what's in scope, what's out, and how subservice orgs are handled.
  3. Module 3, The Controls: A baseline control set mapped to the Common Criteria families.
  4. Module 4, Evidence Auditors Want: An evidence approach that holds across the Type II window, with populations and samples.
  5. Module 5, The Gap Assessment: A self-assessment rating each control and a prioritized remediation roadmap.
  6. Module 6, The Audit & Staying Compliant: An audit plan and a continuous-compliance routine to renew year over year.

What you walk away with

Shareable portfolio

A public URL showing your module timeline, patterns mastered, and completion status.

Everything you build

Download all your work as a ZIP file. It is yours to keep.

Module walkthrough

Each module documented with deliverables and the production pattern you implemented.

Ready to start SOC 2 Readiness?

First course free. $20 per course after that.