SOC 2 readiness

SOC 2 is a report by an independent CPA firm on a service organization's controls, measured against the AICPA Trust Services Criteria. It is not a law: customers ask for it, often in the United States. A Type 1 report covers the design of the controls at a date, a Type 2 report also their operation over a period.

  • SOC 2 – Trust Services Criteria
  • TSP Section 100 (2017, revised 2022)
  • Requirements in the catalogue: 51
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • CC1–CC5

    The control environment, communication, risk assessment, monitoring and control activities, based on the COSO principles.

  • CC6

    Logical and physical access: authentication, granting and removing access, boundary protection, data in transit and malicious software.

  • CC7–CC9

    System operations and incident response, change management, and risk mitigation, including vendors.

  • A1, C1, PI1, P1–P8

    Optional categories: availability, confidentiality, processing integrity and privacy, chosen by what you promise your customers.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The Common Criteria and the optional categories as requirements; an optional category left out of scope is marked Not applicable, with the reason.

  • Controls from the library with test plans and results, mapped to the criteria; the ISO 27001 crosswalk reuses work already done.

  • Evidence with versions, the period it covers and a reviewer, and evidence packs for the auditor.

  • Audit request lists imported from the auditor's spreadsheet, with auditor access limited to the audit.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • CC1 – Control environment5
  • CC2 – Communication and information3
  • CC3 – Risk assessment4
  • CC4 – Monitoring activities2
  • CC5 – Control activities3
  • CC6 – Logical and physical access controls8
  • CC7 – System operations5
  • CC8 – Change management1
  • CC9 – Risk mitigation2
  • A1 – Availability (optional category)3
  • C1 – Confidentiality (optional category)2
  • PI1 – Processing integrity (optional category)5
  • P1-P8 – Privacy (optional category)8

Related frameworks: ISO 27001 ISAE 3402

Common questions

SOC 2 or ISO 27001?

ISO 27001 is a certificate for a management system, recognized worldwide and common in Europe; SOC 2 is an auditor's report on controls, common with US customers. Much of the work overlaps, and the crosswalk shows where.

Does Atitic issue the SOC 2 report?

No. Only an independent CPA firm can. Atitic keeps the controls, tests and evidence ready for it.

What is the difference between Type 1 and Type 2?

A Type 1 report covers whether the controls are suitably designed at a date; a Type 2 report also covers whether they operated effectively over a period, usually six to twelve months.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt SOC 2 in a free trial, link the evidence you already have and see what is still missing.

Start a free trial