# jermsmit/soc2-readiness-guide architecture

> Architecture diagram of the GitHub repository jermsmit/soc2-readiness-guide, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jermsmit/soc2-readiness-guide
- Repository: https://github.com/jermsmit/soc2-readiness-guide

## Overview

This repository is a practical SOC 2 readiness guide for life sciences organizations, not a software runtime. Its principal user journey is to read the readiness topics in sequence—from criteria and scoping through control practices, evidence, audit fieldwork, and ongoing compliance—while using the policy and tracking templates as working materials. The README documents this sequence and the template catalog; no source excerpts were supplied, so the graph represents documented navigation and resource relationships rather than implementation calls.

Main entry points: [`templates/index.md`](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/index.md) (Template catalog), [`templates/trackers/index.md`](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/index.md) (Tracker catalog), [`docs/01-trust-services-criteria.md`](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/01-trust-services-criteria.md) (Trust criteria), [`docs/02-scoping-and-audit-type.md`](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/02-scoping-and-audit-type.md) (Scope & audit type)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_planning["Plan & assess"]
  node_criteria["Trust criteria"]
  node_scope["Scope & audit type"]
  node_gap["Gap assessment"]
end

subgraph group_controls["Control practices"]
  node_policies["Policies &amp; procedures<br/>[index.md]"]
  node_identity["Access &amp; identity"]
  node_vendors["Vendor risk"]
  node_change["Change management"]
  node_incident["Incident response"]
  node_continuity["Continuity &amp; recovery"]
end

subgraph group_audit["Audit &amp; sustain"]
  node_evidence["Evidence collection"]
  node_lifesciences["Life sciences context"]
  node_fieldwork["Auditor &amp; fieldwork"]
  node_continuous["Continuous compliance"]
end

subgraph group_resources["Working templates"]
  node_templateindex["Template catalog<br/>[index.md]"]
  node_accesspolicy["Access policy"]
  node_incidentpolicy["Incident policy"]
  node_vendorpolicy["Vendor risk policy"]
  node_trackerindex["Tracker catalog<br/>[index.md]"]
  node_evidencetracker["Evidence tracker"]
  node_raci["RACI matrix<br/>[raci-matrix.md]"]
end

node_reader(("IT or compliance lead"))

node_reader -->|"read first"| node_criteria
node_reader -->|"browse templates"| node_templateindex
node_reader -->|"browse trackers"| node_trackerindex
node_criteria -->|"then read"| node_scope
node_scope -->|"then read"| node_gap
node_gap -->|"then read"| node_policies
node_policies -->|"then read"| node_identity
node_identity -->|"then read"| node_vendors
node_vendors -->|"then read"| node_change
node_change -->|"then read"| node_incident
node_incident -->|"then read"| node_continuity
node_continuity -->|"then read"| node_evidence
node_evidence -->|"then read"| node_lifesciences
node_lifesciences -->|"then read"| node_fieldwork
node_fieldwork -->|"then read"| node_continuous
node_templateindex -->|"lists"| node_accesspolicy
node_templateindex -->|"lists"| node_incidentpolicy
node_templateindex -->|"lists"| node_vendorpolicy
node_trackerindex -->|"lists"| node_evidencetracker
node_trackerindex -->|"lists"| node_raci

click node_criteria "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/01-trust-services-criteria.md"
click node_scope "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/02-scoping-and-audit-type.md"
click node_gap "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/03-gap-assessment.md"
click node_policies "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/04-policies-and-procedures/index.md"
click node_identity "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/05-access-control-and-identity.md"
click node_vendors "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/06-vendor-and-third-party-risk.md"
click node_change "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/07-change-management.md"
click node_incident "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/08-incident-response.md"
click node_continuity "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/09-business-continuity-dr.md"
click node_evidence "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/10-evidence-collection.md"
click node_lifesciences "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/11-life-sciences-considerations.md"
click node_fieldwork "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/12-audit-prep-and-auditor-selection.md"
click node_continuous "https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/13-continuous-compliance.md"
click node_templateindex "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/index.md"
click node_accesspolicy "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/access-control-policy.md"
click node_incidentpolicy "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/incident-response-policy.md"
click node_vendorpolicy "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/vendor-risk-management-policy.md"
click node_trackerindex "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/index.md"
click node_evidencetracker "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/evidence-tracker.md"
click node_raci "https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/raci-matrix.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_criteria,node_scope,node_gap toneBlue
class node_policies,node_identity,node_vendors,node_change,node_incident,node_continuity toneAmber
class node_evidence,node_lifesciences,node_fieldwork,node_continuous toneMint
class node_templateindex,node_accesspolicy,node_incidentpolicy,node_vendorpolicy,node_trackerindex,node_evidencetracker,node_raci toneRose
class node_reader toneIndigo
```

## Components

### Plan & assess

- [Trust criteria](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/01-trust-services-criteria.md): `docs/01-trust-services-criteria.md`
- [Scope & audit type](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/02-scoping-and-audit-type.md): `docs/02-scoping-and-audit-type.md`
- [Gap assessment](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/03-gap-assessment.md): `docs/03-gap-assessment.md`

### Control practices

- [Policies & procedures](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/04-policies-and-procedures/index.md): `docs/04-policies-and-procedures/index.md`
- [Access & identity](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/05-access-control-and-identity.md): `docs/05-access-control-and-identity.md`
- [Vendor risk](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/06-vendor-and-third-party-risk.md): `docs/06-vendor-and-third-party-risk.md`
- [Change management](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/07-change-management.md): `docs/07-change-management.md`
- [Incident response](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/08-incident-response.md): `docs/08-incident-response.md`
- [Continuity & recovery](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/09-business-continuity-dr.md): `docs/09-business-continuity-dr.md`

### Audit & sustain

- [Evidence collection](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/10-evidence-collection.md): `docs/10-evidence-collection.md`
- [Life sciences context](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/11-life-sciences-considerations.md): `docs/11-life-sciences-considerations.md`
- [Auditor & fieldwork](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/12-audit-prep-and-auditor-selection.md): `docs/12-audit-prep-and-auditor-selection.md`
- [Continuous compliance](https://github.com/jermsmit/soc2-readiness-guide/blob/main/docs/13-continuous-compliance.md): `docs/13-continuous-compliance.md`

### Working templates

- [Template catalog](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/index.md): `templates/index.md`
- [Access policy](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/access-control-policy.md): `templates/policies/access-control-policy.md`
- [Incident policy](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/incident-response-policy.md): `templates/policies/incident-response-policy.md`
- [Vendor risk policy](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/policies/vendor-risk-management-policy.md): `templates/policies/vendor-risk-management-policy.md`
- [Tracker catalog](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/index.md): `templates/trackers/index.md`
- [Evidence tracker](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/evidence-tracker.md): `templates/trackers/evidence-tracker.md`
- [RACI matrix](https://github.com/jermsmit/soc2-readiness-guide/blob/main/templates/trackers/raci-matrix.md): `templates/trackers/raci-matrix.md`

### Other components

- **IT or compliance lead**

## Connections

- IT or compliance lead → Trust criteria: read first
- IT or compliance lead → Template catalog: browse templates
- IT or compliance lead → Tracker catalog: browse trackers
- Trust criteria → Scope & audit type: then read
- Scope & audit type → Gap assessment: then read
- Gap assessment → Policies & procedures: then read
- Policies & procedures → Access & identity: then read
- Access & identity → Vendor risk: then read
- Vendor risk → Change management: then read
- Change management → Incident response: then read
- Incident response → Continuity & recovery: then read
- Continuity & recovery → Evidence collection: then read
- Evidence collection → Life sciences context: then read
- Life sciences context → Auditor & fieldwork: then read
- Auditor & fieldwork → Continuous compliance: then read
- Template catalog → Access policy: lists
- Template catalog → Incident policy: lists
- Template catalog → Vendor risk policy: lists
- Tracker catalog → Evidence tracker: lists
- Tracker catalog → RACI matrix: lists