FlowDiagram
Security & identityMermaid

SOC 2 audit readiness template

Scoping, control design, evidence collection and the audit window — the path a SaaS company follows to its first SOC 2 Type II report. This architecture diagram template contains 16 labelled components, branches such as “Yes”, “No”.

Open in the editor →
  • Free — no account, no trial, no watermark
  • Fully editable shapes and connectors, not a screenshot
  • Export PNG, SVG or PDF, or share it as a link
  • Private: the diagram never leaves your browser

Components in this architecture diagram

  • Decide to pursue SOC 2
  • Choose trust criteria & scope
  • Gap assessment
  • Write policies
  • Implement controls: access, change, vendor, backup
  • Compliance automation connected
  • Readiness assessment
  • Gaps remain?
  • Select auditor
  • Type II observation window: 3-12 months
  • Continuous evidence collection
  • Control failure?
  • Remediate & document
  • Auditor fieldwork & sampling
  • Management response to exceptions
  • SOC 2 report issued

How to use this architecture diagram template

  1. Click Open in the editor. The architecture diagram opens on a new page in FlowDiagram — nothing is uploaded and there is no sign-up.
  2. Rename, add or delete shapes and drag them where you want; connectors stay attached as things move.
  3. Drop in vendor logos from the library — 1,160 of them, including every AWS, Azure and Google Cloud service icon — or restyle it with the colour and theme controls.
  4. Prefer text? Edit the Mermaid source below and paste it in through ☰ → Import diagram (see the Mermaid editor); it imports as an editable diagram.
  5. Export to PNG, SVG or PDF, or press Ctrl+L for a link that carries the whole diagram.

Mermaid source

The whole template is the text below. Paste it into FlowDiagram, keep it in Git next to the code it describes, or hand it to an AI assistant to extend.

flowchart LR
  A((Decide to pursue SOC 2)) --> B[Choose trust criteria & scope]
  B --> C[Gap assessment]
  C --> D[Write policies]
  D --> E[Implement controls: access, change, vendor, backup]
  E --> F[Compliance automation connected]
  F --> G[Readiness assessment]
  G --> H{Gaps remain?}
  H -->|Yes| E
  H -->|No| I[Select auditor]
  I --> J[Type II observation window: 3-12 months]
  J --> K[Continuous evidence collection]
  K --> L{Control failure?}
  L -->|Yes| M[Remediate & document]
  M --> K
  L -->|No| N[Auditor fieldwork & sampling]
  N --> O[Management response to exceptions]
  O --> P((SOC 2 report issued))

Related: System architecture diagram tool · Mermaid editor · All security & identity templates · All 521 templates