SOC 2 Marketing Readiness Checklist
The 42 Trust Services Criteria that most marketing teams fail during a SOC 2 audit. Covers Security, Availability, Confidentiality, Privacy, and Processing Integrity. Export status as evidence log for auditors.
Compliance Intelligence
Marketing teams fail SOC 2 audits more than engineering: vendor sprawl, shared logins, uncontrolled data exports.
When a company goes through SOC 2 Type II, the marketing stack is usually the biggest gap. Dozens of vendors, no inventory, personal accounts for shared tools, GSC data pulled into personal Google accounts, campaign exports sitting on local drives. This checklist flags the 42 marketing-specific controls auditors look for.
Scope
Readiness checklist
Readiness summary
Export
How this scores
Each control counts once. "Not applicable" is removed from the denominator.
85%+ Audit-ready
60–84% Readiness programme needed
<60% Material gaps
Frequently asked questions
What is SOC 2?
A trust framework from the AICPA covering security, availability, confidentiality, privacy, and processing integrity. Standard for US B2B SaaS trust reviews.
Why does marketing care about SOC 2?
Marketing holds a large share of customer data: CRM, email lists, campaign records. The marketing stack is often the biggest gap during a SOC 2 audit.
What is Type I vs Type II?
Type I: controls designed well at a point in time. Type II: controls operated effectively over 6 to 12 months. Type II is the credible one.
Who performs a SOC 2 audit?
A licensed CPA firm. Costs range $20k to $100k+ depending on scope and company size.
What marketing controls get flagged most?
Shared logins, no MFA on SaaS, uncontrolled data exports to personal drives, no vendor risk reviews on marketing tools, missing access reviews.
How long does SOC 2 Type II take to achieve?
12 to 18 months from zero. 6-month minimum observation window after controls are in place.
What is the Common Criteria (CC)?
The security section of SOC 2. All 5 Trust Services Criteria map to numbered controls. Marketing controls fit primarily into CC and the Privacy pillar.
Does the marketing team own all controls?
No. Shared with IT, security, legal. Marketing owns its stack-specific controls (access, exports, vendor reviews).
What is a sub-service organisation?
A vendor whose controls are relied upon. Google Workspace, HubSpot, Salesforce. Their SOC 2 reports are evidence; your controls layer on top.
How does SOC 2 relate to GDPR?
Different frameworks with overlapping requirements. GDPR focuses on EU data subjects; SOC 2 focuses on vendor trust. Many controls serve both.
What is the SOC 2 "scope"?
Which systems and processes are in-audit. Marketing often starts out of scope but gets pulled in as auditors recognise the risk surface.
Free · no account
SEORCE for Chrome, Edge and Firefox
Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.
It audits one page at a time and does not track AI answers. About the extension
For teams and agencies
The whole job of search and AI, in one platform.
Rankings, AI visibility, technical fixes, content and reporting sit in one project. Reports export to Excel, PDF and Google Sheets on a schedule, and pricing is per project, never per seat.
3,000+ users · Free forever plan, no card needed