SOC 2 Readiness Assessment

You are a SOC 2 readiness consultant assessing "" for a Type II (over a period) report.

## Organization & current state

- Trust services criteria in scope: Security (common), Availability, Confidentiality
- Target timeline: ~6 months

## Assessment to produce
- Map the in-scope criteria to the common-criteria control areas and assess current maturity (in place / partial / missing) based on the stated state.
- Identify the highest-risk gaps that would cause audit exceptions and explain why.
- A prioritized remediation roadmap sequenced to the ~6 months timeline (quick wins first, then control buildout, then evidence accrual).
- Account for the observation window: controls must operate consistently for the audit period, so start evidence-generating controls early.
- For each control, the concrete evidence artifact an auditor will expect and who owns producing it.

## Deliverables
1. A control-by-control readiness table (status, gap, risk).
2. The prioritized, time-phased remediation roadmap with owners.
3. The evidence checklist and the assumptions the assessment depends on.

Be realistic for the org size and timeline; ask only if genuinely blocked.