SOC 2 readiness template
SOC 2 Control Narrative Template
A practical outline for describing how a control operates, what evidence supports it, and what still needs expert review.
Use the reviewable outline below before deciding whether to start a guided workflow.
What this template helps you prepare
A control narrative is more useful to a reviewer when it explains what happens, who performs it, how often it happens, and what evidence exists. Start by confirming the Trust Services Criteria (TSC) categories in scope. Security is always required; Availability, Processing Integrity, Confidentiality, and Privacy depend on the service commitments and engagement.
Use the outline below as a working draft. Replace every bracketed item with facts your organization can support. Do not invent controls or evidence to make a narrative look complete.
SOC 2 control narrative template outline
| Section | Include | Reviewer should confirm |
|---|---|---|
| Document scope | Entity name, report type, period or as-of date, in-scope TSC categories, and excluded categories | The scope agrees with the engagement plan and service commitments. |
| Criterion heading | The applicable criterion, such as CC6 for logical and physical access | The criterion is actually in scope and is not confused with a control objective. |
| Control objective | A concise statement of the intended outcome | The objective matches the criterion and does not overstate what the organization does. |
| Control narrative | The activity, responsible role, system or procedure used, cadence, approvals, and exceptions | The description is specific enough to test and reflects current practice. |
| Evidence reference | Named policy, system report, ticket sample, log, meeting record, or other artifact | The evidence exists, is current for the period, and can be retrieved. |
| Owner and status | Accountable owner, evidence status, and open question | Ownership and missing evidence are visible before the review meeting. |
Reusable per-criterion block
## [Criterion] — [short criterion name]
**Control objective:** [Outcome this control is intended to achieve.]
**Control narrative:** [Role] performs [activity] using [system or procedure]
[when / how often]. [Approval, review, or exception path.] The activity applies to
[in-scope people, systems, or data].
**Evidence:** [Named policy or procedure]; [named report, ticket, log, or record];
[period or sample reference].
**Owner:** [role]
**Open review items:** [missing evidence, scope question, or none]
Example evidence matrix
| Criterion | Narrative status | Evidence to collect | Owner | Review question |
|---|---|---|---|---|
| CC1 | Draft | Board charter; organization chart; management meeting record | Compliance lead | Does the narrative show actual oversight activities? |
| CC6 | Draft | Access policy; quarterly review report; termination checklist | IT operations lead | Are access-review cadence and exceptions evidenced? |
| CC7 | Draft | Incident runbook; incident record; tabletop notes | Security lead | Does the narrative name the escalation and follow-up process? |
Ready to turn this outline into a working draft?
Start the SOC 2 control narrative workflowStart with your real inputs. Rakenne guides the draft and checks its workflow rules; your qualified reviewer remains responsible for the final document.
Information to gather before drafting
- The proposed report type and scope: Type I as of a date, or Type II over an agreed period.
- The selected TSC categories and the systems, teams, locations, and services they cover.
- Current policies, procedures, runbooks, tickets, reports, and records that support each claimed activity.
- The responsible role, frequency, approvals, and exception route for each control.
- Known gaps: criteria with no owner, evidence that is unavailable, or controls that exist only informally.
Checks to run, and what they do not decide
The matching Rakenne workflow can check whether every in-scope criterion has a narrative and an evidence reference. It can also flag generic wording that omits practical details such as who, what, how, when, or where.
Those checks are drafting safeguards, not an audit opinion. A control owner should confirm the operational facts and evidence; a qualified SOC 2 professional or service auditor should determine whether the description, scope, and evidence are suitable for the engagement.
Common review questions
Should the evidence column contain links to files?
Use stable, retrievable references appropriate to your evidence process. A reviewer still needs to confirm that the referenced artifact is the right version and covers the period under review.
What if a criterion is only partly implemented?
Record the gap plainly. A template is useful because it makes missing ownership, evidence, and exception handling visible; it should not turn an incomplete practice into a completed claim.
Is a policy enough to support a control narrative?
Usually not by itself. A policy may state the intended rule, while operating evidence such as a review report, ticket, log, or meeting record helps demonstrate that the activity occurred.
Related SOC 2 resources
- SOC 2 Control Narrative Author — guided drafting and coverage checks for the underlying workflow.
- Guided elaboration of SOC 2 readiness documentation — a concrete drafting-and-validation walkthrough.
- SOC 2 Readiness Gap Analysis — identify unmapped criteria and build a remediation plan before finalizing narratives.
- Rakenne vs ChatGPT for SOC 2 control narratives — compare the two approaches with a fixed scenario and stated limitations.