Framework template
The assurance report most SaaS and cloud service providers are asked for. SOC 2 evaluates controls across five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
Bundled template
SOC 2 Type II
52 controls · 5 categories
| Control | Category |
|---|---|
| CC1.1COSO Principle 1 | Security |
| CC1.2COSO Principle 2 | Security |
| CC1.3COSO Principle 3 | Security |
| CC1.4COSO Principle 4 | Security |
| CC1.5COSO Principle 5 | Security |
| CC2.1COSO Principle 13 | Security |
| CC2.2COSO Principle 14 | Security |
| CC2.3COSO Principle 15 | Security |
| and 44 more | |
Service Organization Control 2
In practice
A SOC 2 report is an auditor's opinion that your controls are designed (Type I) and operating (Type II) against the AICPA Trust Services Criteria. It rests on documented policies, evidence that the controls ran, and someone who can produce that evidence on request.
Requirements
01
Protection against unauthorised access through logical and physical safeguards: access control, change management, monitoring and incident response.
02
Uptime and performance monitoring, disaster recovery plans and the procedures that show they are exercised.
03
Processing that is complete, valid, accurate, timely and authorised.
04
Encryption, access restriction and classification for information designated as confidential.
05
Collection, use, retention, disclosure and disposal of personal information in line with the commitments made.
How the Desk helps
Each step below is shipped: the template import in Compliance Studio, and workflows that run over the documents you choose, record their sources and hold for approval before export.
Import the SOC 2 control set from the template and record the status and owner of each control, so the programme starts from the criteria rather than a blank spreadsheet.
Run Review controls over your security policies. The run records every policy it read and holds for approval before it exports.
Each control holds its evidence with a status and an owner in Compliance Studio, and a control memo names the gaps and the remediation steps. Prepare audit checklist runs over the documents you select and exports as a PDF once approved.
Other templates
Next step
Bring the policies you have and the last audit's request list. We will import the template, run the workflows with you and hand back the controls, the evidence on file and each run's sources.
Security
GDPR and CCPA compliant, ISO 27001 aligned, SOC 2 Type II in progress. Encrypted at rest and in transit. Your data never trains a model.
Security page