SOC 2, from the first gap to fieldwork

The Trust Services Criteria arrive mapped to the same control set as every other framework you run, so a control you satisfy here counts everywhere else it applies. Evidence is collected, dated and checked as you go, not assembled in the fortnight before fieldwork.

  • Type 1 and Type 2 run on one control set
  • CC1 to CC9, mapped to the controls you already run
  • Evidence dated across the whole observation window
  • Your CPA firm gets scoped access, not a shared drive

Runs alongside

See SOC 2 in Cyberwiz

A walkthrough built around your stack, your scope, and the SOC 2 evidence you have to produce.

We use your details to arrange the demo and follow up about Cyberwiz. Read the privacy policy.

SOC 2 Type 2

Organization-wide · 2017 TSC · 63 controls

Adopted
Readiness
71%
Controls in scope
63
Evidence current
148
Open tasks
9

SOC 2 coverage

CC1Control environmentIn progress
CC2Communication and informationImplemented
CC3Risk assessmentEvidence expiring
CC4Monitoring activitiesIn progress
CC5Control activitiesImplemented
CC6Logical and physical accessImplemented
Published by
AICPA
Structure
Five categories, CC1–CC9
Signed by
A licensed CPA firm
Covers
A window, for Type 2

  • 01

    Adopt it, don't rebuild it

    The criteria come mapped to common controls, so the access review that answers CC6.2 answers ISO 27001's A.5.18 in the same motion. Scope the categories your commitments require and leave the rest out with the reason recorded.

  • 02

    Evidence with a date on it

    A Type 2 opinion is about a window, so every piece of evidence carries the date it was true and the date it expires. A quarterly review that slips becomes a task with an owner the week it slips, rather than a finding in fieldwork.

  • 03

    What the assessor leaves with

    Invite your CPA firm to the frameworks and dates of the engagement and to nothing else. They read controls and evidence where they live, and export control status and evidence packs without a shared drive in between.

What you adopt

SOC 2, in its own numbering

  • CC1Control environment
  • CC2Communication and information
  • CC3Risk assessment
  • CC4Monitoring activities
  • CC5Control activities
  • CC6Logical and physical access
  • CC7System operations
  • CC8Change management
  • CC9Risk mitigation

Every engagement covers the common criteria. Availability, Processing Integrity, Confidentiality and Privacy are added when your commitments call for them.

What you show

What an assessor will ask to see

  • Access reviews on the cadence you claim

    CC6.1 to CC6.3. Who can reach what, reviewed on a schedule, with the removals actually made and dated.

  • Change management

    CC8.1. Changes reviewed, approved and traceable to the person who shipped them.

  • Vendor due diligence

    CC9.2. The third parties in your critical path, assessed before they are onboarded and reassessed on a cycle.

  • Monitoring and incident response

    CC7.1 to CC7.5. Logging, alerting, and incidents with timestamps, an owner and a resolution.

  • Policies people have read

    CC1 and CC2. Published policies, current versions, and an acknowledgement per person rather than per team.

  • Risk assessment

    CC3. Documented, current, and tied to what you decided to do about each risk you found.

How it runs

  1. Step 1

    Adopt SOC 2

    Your organization gets its own copy of every control in SOC 2, already mapped to the common controls you may satisfy for something else.

  2. Step 2

    Scope it

    Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.

  3. Step 3

    Collect the evidence

    Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.

  4. Step 4

    Prove it

    Invite your assessor to these frameworks and these dates, and nothing else. They leave with control status and evidence packs, in the shape your CPA firm asked for.

Book a SOC 2 walkthrough
See the platform

The standard

What SOC 2 asks for

SOC 2 is an attestation, not a certificate. A licensed CPA firm examines your controls against the AICPA's Trust Services Criteria and issues a report with an opinion in it: Type 1 describes how your controls were designed at a point in time, Type 2 tests whether they actually operated across a window, usually three to twelve months.

Every engagement covers the Security category: the common criteria, CC1 through CC9. Availability, Processing Integrity, Confidentiality and Privacy are added when the commitments you have made to customers call for them. The scope is yours to pick, and the pick is what the report gets read against.

Nobody passes SOC 2. The output is a document your buyers' security teams read line by line, which is why the Type 2 window matters more than the checklist: what you are proving is that the control ran every time it was meant to, not that it existed on the day somebody looked.

Questions

Type 1 or Type 2 first?
Type 1 is the faster answer to a buyer who is blocking a deal today, because it describes design at a point in time and does not need an observation window. It is worth doing only if it unblocks something specific: most buyers ask for Type 2 next, and the work is the same work.
How long does the Type 2 window have to be?
Three months is the shortest window most buyers will accept, and a first report often uses it. After that the window is usually twelve months, running continuously so there is no gap between one report and the next.
Does Cyberwiz issue the report?
No. Only a licensed CPA firm can. Cyberwiz is where the controls, the evidence and the auditor's scoped access live, so the firm examines a live program instead of a folder someone assembled for them.

Also supported

Provable today, not at audit time.

Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.

Get a demo
Open the app