How jermsmit/soc2-readiness-guide works
This repository is a practical SOC 2 readiness guide for life sciences organizations, not a software runtime. Its principal user journey is to read the readiness topics in sequence—from criteria and scoping through control practices, evidence, audit fieldwork, and ongoing compliance—while using the policy and tracking templates as working materials. The README documents this sequence and the template catalog; no source excerpts were supplied, so the graph represents documented navigation and resource relationships rather than implementation calls.
Main entry points: templates/index.md Template catalog · trackers/index.md Tracker catalog · 01-trust-services-criteria.md Trust criteria · 02-scoping-and-audit-type.md Scope & audit type
Components 21
Plan & assess
- Trust criteria
docs/01-trust-services-criteria.md - Scope & audit type
docs/02-scoping-and-audit-type.md - Gap assessment
docs/03-gap-assessment.md
Control practices
- Policies & procedures
docs/04-policies-and-procedures/index.md - Access & identity
docs/05-access-control-and-identity.md - Vendor risk
docs/06-vendor-and-third-party-risk.md - Change management
docs/07-change-management.md - Incident response
docs/08-incident-response.md - Continuity & recovery
docs/09-business-continuity-dr.md
Audit & sustain
- Evidence collection
docs/10-evidence-collection.md - Life sciences context
docs/11-life-sciences-considerations.md - Auditor & fieldwork
docs/12-audit-prep-and-auditor-selection.md - Continuous compliance
docs/13-continuous-compliance.md
Working templates
- Template catalog
templates/index.md - Access policy
templates/policies/access-control-policy.md - Incident policy
templates/policies/incident-response-policy.md - Vendor risk policy
templates/policies/vendor-risk-management-policy.md - Tracker catalog
templates/trackers/index.md - Evidence tracker
templates/trackers/evidence-tracker.md - RACI matrix
templates/trackers/raci-matrix.md
Other components
- IT or compliance lead
Connections 20
- IT or compliance lead → Trust criteria: read first
- IT or compliance lead → Template catalog: browse templates
- IT or compliance lead → Tracker catalog: browse trackers
- Trust criteria → Scope & audit type: then read
- Scope & audit type → Gap assessment: then read
- Gap assessment → Policies & procedures: then read
- Policies & procedures → Access & identity: then read
- Access & identity → Vendor risk: then read
- Vendor risk → Change management: then read
- Change management → Incident response: then read
- Incident response → Continuity & recovery: then read
- Continuity & recovery → Evidence collection: then read
- Evidence collection → Life sciences context: then read
- Life sciences context → Auditor & fieldwork: then read
- Auditor & fieldwork → Continuous compliance: then read
- Template catalog → Access policy: lists
- Template catalog → Incident policy: lists
- Template catalog → Vendor risk policy: lists
- Tracker catalog → Evidence tracker: lists
- Tracker catalog → RACI matrix: lists