Free Checklist Templates for Soc2

Soc2

OR

Change Management Checklist

Request Intake and Scoping

Open the change ticket in Jira

Classify the change risk tier

Identify blast radius and dependent services

Notify dependent service owners in Slack

Change Plan and Rollback

Document the deploy steps in the runbook

Write the rollback procedure

Define success metrics and SLO impact

Assign the release captain and on-call backup

CAB Review and Approval

Submit the CR to the Change Advisory Board

Walk through the change in CAB

Capture the CAB decision

Resolve CAB-imposed conditions

Deploy Window Execution

Confirm no active SEV1 or SEV2 incidents

Lock main branch for the deploy window

Run the database migration first

Deploy backend canary at 5%

Roll out backend to 25, 50, then 100 percent

Deploy frontend after backend is stable

Confirm deploy outcome

Rollback Path

Page the incident commander

Execute the documented rollback

Verify production is healthy after rollback

Post-Deploy Verification

Run the production smoke test suite

Watch error rate and p99 for 30 minutes

Check Sentry for new exception signatures

Flip planned feature flags

Closure and SOC 2 Evidence

Tag the release in git

Publish the changelog and release notes

Attach evidence to the Vanta change-management control

Schedule a retro if the deploy went sideways

Close the change request ticket

View Workflow Use Workflow

Compliance Audit Checklist

Audit Scoping & Kickoff

Confirm the in-scope frameworks for this audit

Identify the in-scope systems and data stores

Notify control owners of evidence requests

Access Control Review

Export the active user roster from Entra ID

Verify MFA enforcement and block legacy auth

Run the quarterly user access review

Audit privileged and service accounts

Confirm offboarding ran clean for departures this period

Remediate access control findings

Data Protection & Backup

Confirm encryption at rest on endpoints and servers

Verify TLS configuration on external services

Run the quarterly restore drill

Confirm immutable / air-gapped backup copy

Review DLP alerts and data retention enforcement

Network Security & Vulnerability Management

Review firewall rule base for stale entries

Run authenticated vulnerability scan

Confirm patch compliance across the fleet

Validate network segmentation between zones

Review SIEM coverage and alert tuning

Incident Response Readiness

Confirm IR plan reflects current tooling and contacts

Run a tabletop exercise against a relevant scenario

Review incident tickets from the audit period

Verify breach notification timelines are documented

Policy & Awareness

Confirm policy set is current and approved

Verify security awareness training completion

Review vendor risk and SOC reports on file

Findings & Sign-Off

Compile findings register with severity and owner

Determine whether remediation extends past audit window

Escalate open findings to leadership for sign-off

Sign off on the audit readiness package

View Workflow Use Workflow

Database Security Checklist

Scope and Instance Inventory

Inventory all production database instances

Classify each database by sensitivity tier

Confirm DBA and business owner per instance

Access Control and Authentication

Audit privileged accounts in the PAM vault

Verify MFA enforcement on DBA jump hosts

Reconcile RBAC roles against the HR roster

Rotate service account passwords past SLA

Disable shared sa and SYSDBA logins

Remediate access exceptions with manager approval

Encryption and Key Management

Confirm TDE enabled on Tier 1 instances

Verify TLS 1.2+ on database listeners

Rotate column-level encryption keys per policy

Validate KMS key policies and grants

Configuration Hardening and Patching

Run CIS Benchmark scan on each instance

Apply the latest vendor CPU and security patches

Disable xp_cmdshell and risky stored procedures

Restrict listener access via firewall and VPC ACLs

Remove sample schemas and demo accounts

Monitoring, Logging, and Audit

Confirm database audit logs forward to SIEM

Tune alerts for failed-login bursts

Review audit logs for unauthorized DDL

Validate DAM rules against the threat model

Schedule penetration test of the database tier

Backup, Recovery, and DR

Verify nightly backups completed and checksummed

Confirm an immutable offsite copy in a separate account

Run the quarterly restore drill into an isolated environment

Document RPO and RTO results from the drill

Open a P1 incident for the failed restore drill

Quarterly Review Sign-Off

Sign off on the quarterly database security review

View Workflow Use Workflow

Disaster Recovery Plan Checklist

Risk Assessment and Business Impact Analysis

Inventory tier-1 services and their dependencies

Document RTO and RPO targets per service

Score threat scenarios against likelihood and impact

Recovery Strategy and Site Topology

Select the recovery topology per service tier

Designate the DR team and on-call rotation

Verify cross-region IAM, KMS, and secrets replication

Plan Documentation

Write per-service failover runbooks in the wiki

Document the database failover and promotion procedure

Map controls to SOC 2 and HIPAA requirements

Backup and Replication

Configure automated RDS snapshots with PITR

Replicate S3 buckets cross-region with versioning

Back up Terraform state and secrets offsite

Run the quarterly restore drill

File remediation tickets for failed restores

DR Testing and Maintenance

Run a tabletop walkthrough with on-call engineers

Execute a failover drill in the DR region

File drill action items in Jira

Activation Decision

Confirm SEV1 trigger conditions are met

Page the incident commander via PagerDuty

Decide whether to activate the DR plan

Recovery Execution and Post-Incident

Execute the failover runbook in the DR region

Validate data integrity against RPO targets

Hold the blameless post-incident review

View Workflow Use Workflow

Employee Data Security Checklist

Training and Awareness

Run the quarterly security awareness module

Run a simulated phishing campaign

Schedule remediation 1:1s for failed simulations

Identity and Access

Audit IAM roles with production access

Verify SSO and MFA enforcement

Off-board accounts for departed engineers

File revocation tickets for orphaned access

Secrets and Encryption

Scan repos for committed secrets

Rotate exposed credentials and rewrite history

Confirm KMS encryption at rest on data stores

Check TLS certificate expirations

Endpoints and Network

Verify MDM enrollment on engineer laptops

Review VPN and bastion access logs

Triage open vulnerability findings

Backups and Recovery

Verify nightly backup success across data stores

Run a restore drill into a non-prod account

File a SEV2 ticket to fix the broken restore path

Monitoring and Sign-Off

Review Datadog security signals and audit logs

File quarterly evidence in the SOC 2 folder

Sign off on the quarterly review

View Workflow Use Workflow

Employee Offboarding Checklist

Departure Intake

Capture last working day and departure type

Confirm production access level

Notify the manager and team lead

Knowledge Transfer

Reassign open Jira tickets and PRs

Update CODEOWNERS and on-call rotations

Document tribal knowledge for owned services

Hold a 1:1 handoff with the receiving engineer

Production Access Rotation

Rotate shared production secrets and break-glass credentials

Review IAM roles and Kubernetes RBAC bindings

Access Revocation

Deprovision SSO and revoke active sessions

Remove from GitHub org and disable PATs

Revoke cloud and infrastructure access

Remove from Slack channels and mailing lists

Equipment and Asset Return

Ship return kit or schedule device pickup

Wipe and reimage returned hardware via MDM

Collect office badges and YubiKeys

Payroll, Benefits, and Legal

Process final paycheck and unused PTO payout

Send COBRA and benefits continuation notice

Confirm signed confidentiality and IP agreements on file

Communication and Wrap-Up

Announce departure to team and stakeholders

Conduct exit interview

Update org chart and Backstage service catalog

File SOC 2 offboarding evidence in compliance tracker

View Workflow Use Workflow

IT Regulatory Compliance Review

Data Privacy and Protection

Verify endpoint disk encryption coverage

Confirm TLS enforcement on internal services

Audit RBAC group membership in Entra ID

Review DLP policies in Microsoft Purview

Validate data classification on sensitive shares

User Authentication and Access

Confirm MFA enforcement via conditional access

Block legacy authentication protocols

Audit privileged accounts in PAM

Run quarterly Entra ID access review

Disable accounts inactive beyond 90 days

Verify SSO coverage across SaaS inventory

Security Monitoring and Incident Response

Validate SIEM log ingestion from critical systems

Run authenticated vulnerability scan

File emergency change for critical CVEs

Review unresolved EDR detections

Run a ransomware tabletop exercise

Confirm patch compliance from RMM

Compliance Documentation and Reporting

Update control evidence in IT Glue or Hudu

Reconcile software license inventory

Conduct internal compliance audit

Schedule security awareness training rollout

Sign off on the quarterly compliance report

View Workflow Use Workflow

Quarterly Security Review Checklist

Security Governance & Policy

Review InfoSec policies against CIS Controls v8

Confirm the InfoSec RACI matrix

Tabletop the incident response runbook

Run the quarterly risk assessment review

Schedule a risk treatment session with the CISO

Network Security Controls

Audit the NGFW rule base for stale ACLs

Verify TLS 1.2+ on internet-facing endpoints

Validate WPA3 and 802.1X on corporate wifi

Review VLAN segmentation between user and prod

Application Security Testing

Run SAST and SCA scans on production repos

Schedule the quarterly penetration test

Confirm patch SLAs for KEV-listed CVEs

Data Protection & Backup

Verify encryption at rest across S3, RDS, and EBS

Run the quarterly access review on sensitive data shares

Execute a backup restore from immutable storage

Open a Sev-2 ticket to remediate the failed restore

Endpoint & Identity Hardening

Audit EDR coverage across enrolled endpoints

Reinstall EDR on uncovered endpoints

Verify FIDO2 enrollment for privileged accounts

Review Tenable critical CVE findings

Audit IAM roles against the least-privilege baseline

Workforce Security & Awareness

Deliver the quarterly phishing simulation

Schedule targeted retraining for repeat clickers

Confirm background check completion for new hires

Audit BYOD device enrollment in MDM

Rotate service account credentials in the vault

View Workflow Use Workflow

Security Best Practices Checklist

Secure Coding Practices

Audit IAM scopes against least privilege

Verify input validation on all external boundaries

Review error handlers for sensitive leakage

Scan repos for committed secrets

Authentication and Access Control

Verify MFA enforcement on GitHub, AWS, and SSO

Run quarterly access review across production systems

Revoke flagged access and document in evidence log

Audit session timeouts and cookie flags

Data Protection and Privacy

Verify TLS 1.2+ and KMS encryption at rest

Confirm certificate auto-renewal is healthy

Review data retention and deletion jobs

Update data inventory and sub-processor list

Application Security Testing

Triage SAST and SCA findings from the quarter

Run DAST scan against staging

Review external pentest report findings

File remediation tickets for critical findings

Network and Infrastructure Security

Audit security groups and ingress rules

Verify Terraform drift across production

Confirm OS and container base image patching

Test backup restore into a non-prod environment

Incident Response and Monitoring

Run an incident response tabletop exercise

Review PagerDuty alert hygiene and on-call load

Verify log retention meets the audit window

Sign off on the quarterly security review

View Workflow Use Workflow

Security Review Checklist

Access Control Review

Run quarterly user access review

Verify MFA enforcement on all admin accounts

Review IAM role permissions for least privilege

Confirm offboarding of departed engineers

Remediate orphaned accounts and document

Data Security

Verify encryption at rest on production data stores

Confirm TLS 1.2+ on all customer-facing endpoints

Scan repos for committed secrets

Rotate exposed secrets and rewrite git history

Verify backup restore from a recent snapshot

Network Security

Audit security group and VPC ingress rules

Review WAF rules and rate limits

Verify TLS certificate auto-renewal is healthy

Application Security

Run SAST scan against main branch

Review dependency CVEs from SCA scan

Audit feature flags for stale entries

Test authentication and authorization paths

System and Patch Management

Confirm OS and base-image patch level

Review Kubernetes RBAC and pod security

Audit production console and SSH access logs

Physical Security and Sign-Off

Verify office and data-center access logs

Review device inventory and disk encryption

File security review sign-off

View Workflow Use Workflow

Server Security Checklist

User and Access Management

Reconcile accounts against the HR roster

Audit privileged group membership

Verify MFA enforcement on admin accounts

Disable accounts inactive 30+ days

Rotate service account credentials

Network Security

Review firewall rules for unused entries

Verify VLAN segmentation boundaries

Patch firewall and switch firmware

Audit VPN access list against active employees

Confirm legacy authentication is blocked

System and Software Updates

Review pending CVEs in the vuln scanner

Deploy patches to the test ring

Confirm test ring stability after 48 hours

Pause rollout and file a patch exception

Promote patches to production

Document deviations and rollback plan

Backup and Recovery

Verify nightly backup job success

Confirm the immutable offsite copy is current

Run a restore drill to an isolated VM

Open an incident for restore failure

Update the DR runbook with measured RPO/RTO

Logging, Monitoring, and Sign-Off

Confirm SIEM ingestion from critical hosts

Tune alert thresholds to reduce noise

Review IOC hits from the last quarter

Verify log retention meets policy

Sign off on the quarterly security review

View Workflow Use Workflow

Ready to take control of your recurring tasks?

Start Free 14-Day Trial

Use Slack? Sign up with one click

With Slack

Company

About
Product Roadmap
API Reference
Privacy Policy
Terms
Contact Us
Blog

Resources

Help
Getting Started Guides
Video Center
Demos
Your Account
Use Cases
Pricing

©Manifestly 2026

When you visit or interact with our sites, services or tools, we or our authorised service providers may use cookies for storing information to help provide you with a better, faster and safer experience and for marketing purposes.