# SOC 2 access review checklist

Use this before your Type 1 date or your first fieldwork request.

## GitHub

- [ ] every org owner is a named person
- [ ] outside collaborators reviewed and either removed or justified
- [ ] stale users removed
- [ ] MFA status checked across relevant accounts
- [ ] branch protection enabled on production-related repos
- [ ] admin teams are documented

## Cloud IAM

- [ ] every admin role maps to a named person or break-glass procedure
- [ ] stale IAM users removed
- [ ] root account protected and reviewed
- [ ] MFA enforced where available
- [ ] excessive wildcard permissions flagged for cleanup

## Identity provider

- [ ] former staff removed
- [ ] privileged groups reviewed
- [ ] MFA policy confirmed
- [ ] audit log retention noted

## Evidence to save

- dated user exports
- dated MFA output
- notes on removed access
- notes on justified exceptions