SOC 2

SOC 2 - Trust Services Criteria

A SOC 2 report provides independent assurance over controls for a defined service system. A CPA firm examines the relevant Trust Services Criteria. Use these guides to prepare evidence and discuss scope; the library entries are not a substitute for the AICPA criteria or the auditor's assessment.

Start my free SOC 2 assessmentNo account · No credit card · Save when useful

Reference guides

Agree the report type and period with your CPA firm

Planning the review

Budget for examination, preparation and remediation

Budget considerations

Agree a reporting cycle with your auditor and customers

Keeping it current

Cross-Framework Control Mapping

Key SOC 2 controls mapped to equivalent requirements in other frameworks. Work done for one framework reduces effort on the others.

SOC 2 Control	ISO 27001	GDPR	NIS2
Logical Access (CC6.1)	A.5.15, A.8.2	Art. 25, Art. 32	Art. 21(2)(i)
Change Management (CC8.1)	A.8.9, A.8.32	Art. 25(1)	Art. 21(2)(e)
Risk Assessment (CC3.1, CC3.2)	Clauses 6.1.2, 8.2	Art. 24, Art. 35	Art. 21(2)(a)
Incident Response (CC7.3, CC7.4)	A.5.24, A.5.26	Art. 33, Art. 34	Art. 21(2)(b)
Availability (A1.1, A1.2)	A.5.29, A.5.30	Art. 32(1)(c)	Art. 21(2)(c)

Where auditors look first

The highest-risk SOC 2 controls - the ones auditors probe earliest and where gaps cost the most. Start your assessment here.

A1.2Availability - Environmental Protections, Backups, and Recovery Infrastructure CC1.1COSO Principle 1: Demonstrates Commitment to Integrity and Ethical Values CC3.2COSO Principle 7: Identifies and Analyzes Risk CC4.1COSO Principle 16: Selects, Develops, and Performs Ongoing and/or Separate Evaluations CC5.1COSO Principle 10: Selects and Develops Control Activities That Mitigate Risks CC5.2COSO Principle 11: Selects and Develops General Controls Over Technology CC6.1Logical and Physical Access - Security Software, Infrastructure, and Architectures CC6.2Logical and Physical Access - User Registration and Authorization

Key SOC 2 terms

Plain-language definitions for the concepts you will meet while working through SOC 2.

Frequently Asked Questions

How do Type 1 and Type 2 differ?

Type 1 addresses control design at a specified date. Type 2 also addresses operating effectiveness over a specified period. Confirm which report the recipient will accept.

How long will the process take?

Plan preparation, the agreed reporting period, fieldwork and report completion separately with your CPA firm. A readiness tool does not shorten the period your report must cover.

Which categories should we include?

Security is the common foundation. Agree additional categories with your auditor based on your services, commitments and customer requirements. Processing personal data alone does not mean every privacy criterion belongs in your report scope.

What does AuditFront provide?

A self-assessment workflow and report based on your answers. It does not issue an independent SOC 2 report; engage a CPA firm for that examination.

Control Categories

This library groups 59 review topics into 5 categories.

Common Criteria (Security)

33 reference guides

Availability

3 reference guides

Confidentiality

2 reference guides

Processing Integrity

5 reference guides

Privacy

16 reference guides

Who Needs SOC 2?

B2B SaaS companiesCloud infrastructure providersData processing companiesFinTech startupsHR technology platformsAPI and integration platforms

Applicable Regions

United StatesCanadaGlobal (US-originated, internationally recognized)

Related Frameworks

Organizations pursuing SOC 2 often also work toward these standards.

ISO 27001 GDPR

Start your SOC 2 self-assessment

Work through the SOC 2 assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save