The 6 SOC 2 Policy Documents Every Auditor Asks For (And How to Draft Them in a Day)
Published July 30, 2026 · 9 min read
TL;DR
Every AICPA-registered SOC 2 auditor asks for the same six core policy documents because the Trust Services Criteria (CC1 through CC9) map cleanly to those six documents. Getting them wrong — missing a policy, using the wrong control citations, submitting generic templates — is the fastest way to fail your first audit or drag it out by another quarter.
Watch: how VylintShield generates the full six-document policy pack from a short readiness assessment (~2 min).
The 6 documents SOC 2 auditors require
1. Risk Assessment Report
What it is: A written analysis of the risks facing your business — technical, operational, legal, and reputational — with a likelihood and impact rating for each, mapped to the Trust Services Criteria that mitigate them.
What auditors check: That the risks are specific to your business (not a generic template), that the ratings are consistent with your operational reality, and that each identified risk has a documented mitigation mapped to a control.
Trust Services Criteria covered: CC3.1 (risk identification), CC3.2 (risk analysis), CC3.3 (risk mitigation), CC3.4 (change management risk)
2. Password and Access Control Policy
What it is: Your organization’s written rules for authentication, authorization, and access provisioning — password requirements, MFA rules, access review cadence, offboarding procedures.
What auditors check: That the policy is enforceable (not aspirational), that access reviews actually happen on the stated cadence, and that offboarded users are removed from systems within the documented SLA.
Trust Services Criteria covered: CC6.1 (logical access), CC6.2 (access provisioning), CC6.3 (access removal), CC6.6 (transmission controls)
3. Data Handling and Privacy Policy
What it is: How your organization classifies, stores, transmits, and disposes of data — especially customer data, personally identifiable information (PII), and sensitive metadata.
What auditors check: That the classifications match how data is actually handled in your systems, that encryption standards (at rest and in transit) are specified concretely, and that data retention/deletion timelines are documented.
Trust Services Criteria covered: CC6.7 (data transmission), CC6.8 (data disposal), C1.1 (confidentiality identification), C1.2 (confidentiality disposal)
4. Incident Response Plan
What it is: The written procedure your organization follows when a security incident is detected — roles, escalation paths, notification timelines, evidence preservation, post-incident review.
What auditors check: That the plan names specific roles (not “the on-call engineer”), that notification timelines meet regulatory requirements (72 hours for GDPR, 60 days for HIPAA, etc.), and that the plan has been tested at least annually.
Trust Services Criteria covered: CC7.3 (incident detection), CC7.4 (incident response), CC7.5 (recovery)
5. Employee Security Awareness Guide
What it is: The written document employees receive during onboarding that covers acceptable use, device policy, phishing awareness, data handling, and reporting expectations.
What auditors check: That every employee has signed acknowledgment of the guide, that annual re-training is documented, and that the guide’s contents align with the other policies (e.g., password rules match the access control policy).
Trust Services Criteria covered: CC1.4 (competence), CC2.2 (internal communication), CC2.3 (external communication)
6. Compliance Checklist
What it is: A control-by-control checklist mapping your operational reality to the specific SOC 2 Trust Services Criteria — with evidence pointers for each control.
What auditors check: That every applicable TSC has a control assigned, that the evidence pointers are specific enough for the auditor to sample, and that gaps are explicitly acknowledged rather than hidden.
Trust Services Criteria covered: All applicable TSC (varies by scope — usually CC1–CC9 for the Security TSC plus any Availability, Confidentiality, or Privacy TSC in scope)
Why manually writing these takes ~40 hours
The math on a first-time SOC 2 policy pack, drafted from scratch by a founder or single security engineer:
| Document | Hours (first draft) | Hours (revision cycles) |
|---|---|---|
| Risk Assessment Report | 6–8 | 2–3 |
| Password and Access Control Policy | 3–4 | 1–2 |
| Data Handling and Privacy Policy | 4–6 | 2–3 |
| Incident Response Plan | 5–7 | 2–3 |
| Employee Security Awareness Guide | 4–5 | 1–2 |
| Compliance Checklist | 4–6 | 2–3 |
| Total | ~30 hours | ~12 hours |
That’s about a week of focused writing time — assuming you already know the TSC framework, have your risk profile mapped, and can produce policies that cite the right criteria without an auditor kicking them back for a rewrite.
Most founders don’t have that time. Most first-time SOC 2 candidates hire a consultant ($15–30k) or subscribe to a GRC platform ($8–15k/year) — both of which take 6–12 weeks just for the policy work.
How to generate the same pack in a day
VylintShield generates all six documents from a single readiness assessment. Here’s the actual flow:
- 1Answer a short assessment about your business — legal name, state, frameworks in scope, tech stack, employee count, existing controls.
- 2Get a compliance gap analysis — the assessment shows you where you’re already compliant and what’s missing.
- 3Generate the pack — six policies, tailored to your business, framework-cited in the scope paragraphs. Not templates. Fully written policies.
- 4Edit with natural language — need to tighten a clause? Ask the AI assistant: "make the encryption clause stricter" and it rewrites in place.
- 5Export as PDF — one click, per policy or the whole pack. Ready to hand to your auditor.
The same policy, generated for a HIPAA customer, cites 45 CFR 164.312 instead of CC6.1 in the scope paragraph. Multi-framework businesses get controls mapped to every framework in one document, with no rewrites.
Start with the free readiness assessment
The readiness assessment is free. You’ll get a compliance gap analysis specific to your business, a preview of what your policy pack would look like, and a cost estimate for the frameworks you’re pursuing.
If the pack works for you, generate the full six documents for $588 a year, billed annually — that works out to $49/month. No per-user pricing, no enterprise contracts.
Start your free readiness assessment →