SOC 2 System Description Skeleton Generator

1. Company and engagement

Company name System / service name Report period Report type

2. Description of services

What the service does for customers

3. System boundaries

In scope (components, locations, teams, systems) Out of scope

4. Commitments and requirements

Principal service commitments (SLAs, contracts, published promises) System requirements (how the system must operate to meet commitments)

5. Infrastructure

Hosting, cloud providers, data centers, network

6. Software and data flows

Applications, databases, and how data moves

7. People

Organizational structure Key roles and responsibilities

8. Subservice organizations

Vendors included via carve-out or inclusive method

9. Complementary user entity controls (CUECs)

Controls customers must operate for your controls to work

10. Trust Services Categories in scope

Security (the Common Criteria) is required in every SOC 2 engagement.

Security (33 criteria, always included) Availability (3 criteria) Processing Integrity (5 criteria) Confidentiality (2 criteria) Privacy (18 criteria)

Generated skeleton

Free SOC 2 system description skeleton generator. Draft the system overview your audit needs.

A readiness aid only. It is not a SOC 2 attestation and not legal advice.