The DIY SOC 2 Checklist: How to Build Compliance Without a Platform

The SOC 2 Series • Your DIY SOC 2 Starter Kit

Welcome back for the heaviest round yet. We promised you a breakdown of the actual checks and tests that happen during a SOC 2 audit – so let’s stop talking about testing in the abstract and get concrete. Below is the real, working checklist: the tasks that compliance teams, IT leads, HR, and auditors all quietly juggle together to make a SOC 2 report happen.

Here’s the twist for this edition: for every single bucket, we’re also showing you the DIY route – how to tackle it yourself, budget-friendly, without needing to sign a contract with an expensive platform on day one. Consider this your DIY SOC 2 starter kit. SOC 2 has a reputation for needing fancy software to pull off. It doesn’t. It needs discipline, documentation, and someone willing to actually do the work. The right tools just make that work faster – but they’re not the only way in. Let’s show you both paths.

A quick honest note before we dive in: this isn’t a numbered list handed down by the AICPA. There’s no official “task 1 through 30” scroll anywhere. What follows is the operational checklist that compliance platforms and audit-readiness teams actually track in practice – organized here into seven logical buckets.

Let’s get into it, bucket by bucket.

Bucket 1: People, Roles & the Employee Lifecycle

SOC 2 cares enormously about people, because most security failures aren’t hackers in hoodies – they’re an ex-employee’s login that never got switched off.

• Assign Core Compliance Roles – Someone needs to own security policy, access reviews, and incident response. Without named owners, “compliance” becomes everyone’s job and therefore nobody’s job.

• Conduct Employee Background Screening and Define Reporting Structure – Verifying who you’re hiring, and keeping a clear chain of command.

• Communicate Roles and Responsibilities to New Joiners – New hires need to know what’s expected of them from day one – job and security responsibilities alike.

• Job Evaluation Is Done – A periodic check that people’s actual system access still matches their actual job.

• Conduct Performance Evaluations – Regular reviews demonstrating people are actively managed, not just hired and forgotten.

• Communicate Role Changes to Employees – When someone moves teams, their access should move with them, documented, not assumed.

• Complete Offboarding Procedures for Terminated Employees – Preventing the classic nightmare: a former employee with working login access weeks after they left.

• Termination Notification – Making sure IT, HR, and security are actually told when someone leaves, on time.

The DIY, budget-friendly way: This whole bucket is genuinely one of the easiest to run on a shoestring. A shared Google Sheet with columns for employee name, role, start date, access granted, and last review date covers most of it. Set calendar reminders for quarterly access reviews and annual performance evaluations – most calendar tools handle recurring reminders at no extra cost. Build a simple offboarding checklist in a shared doc – “revoke email, revoke VPN, revoke Slack, collect laptop” – and have whoever handles HR run through it and check each box the day someone leaves. Background screening is the one exception here; that typically does call for a low-cost external screening service, since you can’t self-verify someone’s criminal or employment history – but everything else in this bucket is spreadsheet-and-checklist territory, not a line item in your software budget.

Bucket 2: Policies, Training & Regulatory Alignment

• Ensure All Policies Are Documented and Acknowledged – Written policies, actually read and formally acknowledged by employees.

• Get Employee Trainings Done – Recurring security awareness training so your team can spot a phishing email.

The DIY, budget-friendly way: You genuinely don’t need to buy a policy template pack. Several reputable sources – including the SANS Institute – publish downloadable security policy templates at no cost, which you can adapt to your company’s specifics instead of writing from a blank page (worth double-checking they’re current before use, since template libraries get refreshed periodically). Track acknowledgment with a simple shared form each employee fills out after reading a policy, logged automatically into a spreadsheet with a timestamp – that timestamp is your evidence. For training, plenty of low-cost or introductory-tier security-awareness content exists (including free entry modules from established training vendors, and general phishing-awareness resources), and you can track completion the same way: a form, a spreadsheet, a date.

Bucket 3: Infrastructure, Access & Asset Management

• Address Infrastructure Gaps – Fixing technical weak points a gap analysis uncovers.

• Set Up Critical Systems and Review Access – Identifying business-critical systems and regularly reviewing who can touch them.

• Maintain Network Diagrams and Software Inventory – A living map of what’s connected to what.

• Maintain an Inventory of IT Assets – Every laptop, server, and device tracked in one place.

• Verify Deployment Approvals and Code Protection – Code changes reviewed and approved before reaching production.

The DIY, budget-friendly way: Version control is the easiest win here – Git itself is free, and platforms like GitHub, GitLab, and Bitbucket all offer entry-level tiers generous enough for most small teams, so there’s really no excuse to skip this one. Network diagrams can be built with low-cost or free-tier diagramming tools like diagrams.net, which export cleanly for an auditor without a subscription fee. Your IT asset and software inventory can start life as, again, a spreadsheet – device name, owner, OS version, last check-in date – updated on a monthly cadence if you don’t have a huge fleet to track. Deployment approvals can be enforced using built-in code review features most version control platforms already include (like required pull request approvals before merging) – no separate purchase needed. This bucket rewards discipline a lot more than it rewards a big budget.

Bucket 4: Risk, Vendor Management & Security Testing

• Confirm Vendor Risk Assessment and Senior Management Approval – Evaluating vendor risk, with sign-off from someone senior.

• Maintain a Risk Register and Perform Periodic Assessments – A living, regularly reviewed list of identified risks.

• Vulnerability Scan Review and Tracking Verification – Scanning for known weaknesses, and tracking whether they actually get fixed.

• Conduct Independent Penetration Testing – An outside team actively trying to break in, the way a real attacker would.

• Test Disaster Recovery and Backup Restoration – Actually attempting to restore from backups, not just assuming they’d work.

The DIY, budget-friendly way: A risk register is just a structured spreadsheet – risk description, likelihood, impact, owner, mitigation plan, review date – and templates for exactly this exist from several credible sources at no cost, if you’d rather not build the columns yourself. Vendor risk assessment can run on a simple questionnaire you send each vendor before signing a contract, with senior sign-off tracked as an email approval or a signature line in the same document. Vulnerability scanning has a genuinely accessible entry point: open-source scanners like OpenVAS cost nothing to run, and commercial scanners often offer a free or low-cost “essentials” tier for a limited number of IP addresses – plenty for many small environments. Disaster recovery testing mostly costs time, not money: schedule an afternoon, actually restore a backup to a test environment, and document what happened, what broke, and how long it took. Penetration testing is the one item here where “fully DIY” gets genuinely difficult – true independent testing needs a third party to be credible to an auditor, though your team can absolutely run free self-assessment frameworks like the OWASP Testing Guide in between formal tests to catch obvious issues early and keep the eventual professional engagement shorter (and cheaper).

Bucket 5: Monitoring & Incident Management

• Track and Maintain Incident Records – Every security incident logged, documented, and followed through to resolution.

The DIY, budget-friendly way: An incident log is one of the simplest things on this entire list to run without spending a rupee or a dollar on software – maintained in confluence / jira or any knowledge base / task tracker tool you are using, and resolution works perfectly well, as long as it’s actually kept up to date the moment something happens rather than reconstructed from memory later.

Bucket 6: Customer-Facing Readiness

• Define Customer Communication and Support Process – A documented, consistent way of handling customer issues.

• Update Website Information – Keep your public-facing pages honest and current: your Privacy Policy actually matches what data you collect today, Terms of Service reflect how the product really works, and there’s a clear way for someone to report a security issue (a security contact or disclosure page). If uptime or data handling are part of your promise, a security/trust page and status page help back that up publicly. The rule of thumb: nothing on the site should say something your internal reality can’t support – that mismatch is exactly what auditors and sharp-eyed customers notice first.

The DIY, budget-friendly way: Write the support process once, as a simple flowchart or doc – who handles what type of request, and how escalations work – and keep it in the same shared folder as everything else. Updating your website is usually just a matter of someone with CMS access actually doing it on a schedule, with a calendar reminder to check quarterly that your security and privacy pages still reflect reality.

The Honest Bottom Line

Every single one of these thirty tasks can be tackled DIY-style, on a genuinely tight budget, with nothing more than spreadsheets, low-cost templates, entry-level tools, calendar reminders, and a disciplined team. That’s not a caveat buried in fine print – it’s simply true. Plenty of companies have earned a real SOC 2 report by going the DIY route, without a single line item for a compliance platform. What you’re trading for “affordable” is time: someone on your team keeping every one of these logs current by hand, chasing evidence manually, and reconstructing what a purpose-built tool would otherwise track automatically in the background.

If you’ve got the discipline and the hours, go build it yourself – genuinely, we mean that. Search around, pull the budget-friendly templates and tools we mentioned, and give your team ownership of the whole process. DIY SOC 2 is a completely legitimate path, and plenty of companies wear it as a badge of honor.

And if, somewhere around task seventeen, the DIY spreadsheets start multiplying faster than you can update them – that’s exactly where Regodit comes in. Regodit exists for the version of this story where you’d rather have the evidence collection, the reminders, and the auditor-ready trail running quietly in the background instead of living across twelve tabs and a shared drive. We’re happy to walk you through what that looks like, whenever you’re ready.

See you in the next edition.