Which report are you being asked for?
The questions change with the framework, because each auditor looks for different evidence.
Nothing is sent unless you ask for the report. Progress is kept in this browser.
How is the readiness score calculated?
Ten questions, each answered on a four-point scale worth zero to three points. Your points are taken as a share of the maximum and expressed out of ten. Answering zero on a question marked critical raises a critical flag, which holds the verdict back no matter what the arithmetic says.
How the scoring works
The question set changes with the framework, because each auditor looks for different evidence. SOC 2 Type 2, SOX 404 and a cybersecurity assessment each have their own ten questions. For SOX 404 and the cybersecurity set every question is treated as critical; for SOC 2, three of the ten are.
Each question offers four answers, ordered from no formal control to a control with a named owner and retained evidence, and they score zero, one, two and three in that order. The four options are written so the honest answer is obvious — the middle two describe what most companies actually do, rather than what they would like to say.
Scoring is deliberately strict about the second-best answer. Answering "partly there" scores two points and is counted as partial, not as in place, because a quarterly review that lives in a spreadsheet with informal sign-off is not evidence an auditor can sample. Counting it as complete is how a company with no retained proof ends up being told it is ready.
A zero on any question flagged critical raises a critical flag, and any critical flag caps both the readiness band and the recommended path at the second band. The score itself is still the plain arithmetic, so the number and the published method never disagree — it is the verdict that is held back, not the total.
A worked example
A SaaS company partway through its first SOC 2 push: written policies and tested backups, quarterly access reviews that live in a spreadsheet with informal sign-off, no vendor risk assessment, no current risk assessment, and evidence gathered by hand at audit time.
- Framework
- SOC 2 Type 2
- Policies, backups
- In place with evidence (3 points each)
- Access review, onboarding, change management, incident response, logging
- Partly there (2 points each)
- Vendors, risk assessment, evidence collection
- Informal or absent (1 point each)
- Raw points
- 19 of 30
- Score
- 6 out of 10
- Time to audit-ready
- 3–5 months
- Recommended path
- Type 1 first
- Areas in place / partly there
- 2 in place, 5 partly there, 0 critical flags
Nineteen points out of thirty is 6 out of 10. Nothing scored zero on a critical question, so no flag caps the verdict and the band is the one the arithmetic gives. The three one-point answers — vendors, risk assessment and evidence collection — are what the gap list leads with, in that order.
Common questions
- Is this an audit?
- No. It is a preliminary readiness screen: ten questions answered by you, scored against a fixed rubric. It is not an audit, not an attestation, not an opinion, and not a prediction of whether you would pass one. Audits and attestations are performed by Alpha Secure LLP under separate engagement letters.
- Why did my score go down when I answered more honestly?
- Because "partly there" is scored as partial rather than in place. A control with no named owner, no ticket and no retained export is real work, but it is not evidence an auditor can sample, and the scorecard is built to say so rather than to flatter the total.
- What is a critical flag?
- A zero on a question the framework treats as critical — for SOC 2 that is access review, onboarding and evidence retention. Any critical flag holds the readiness band and the recommended path at the second band, however high the arithmetic score is, because those gaps are the ones that stop an audit rather than slow it.
- Do I have to give an email address to see my score?
- No. The score, the band and the ranked gap list appear on the page as soon as you finish the questions. An email address is only needed if you want the report sent to you, and progress is kept in your own browser until then.
- Which frameworks can I score against?
- SOC 2 Type 2, SOX 404, and a cybersecurity assessment. A SOC 1 set is registered but not offered: its questions are still a placeholder borrowed from the SOC 2 set, and showing it would mean scoring you against the wrong controls.