Designed correctly, on one date
The auditor checks that your controls are designed properly at a point in time. Faster, and often a first step for early-stage companies.
- Point-in-time review
- Control design
- Weeks, not months
Solutions · SOC 2
SOC 2 Type II, evidence on autopilot.
A Type II report proves your controls worked every day for months, not just on audit day. CompliLens checks your systems daily and keeps the proof, so the observation period runs itself.
Type I or Type II
Two reports, one preparation
Working, every day, for months
The auditor tests that controls operated throughout an observation period, usually three to twelve months. This is the report most enterprise buyers ask for.
- Observation period of 3–12 months
- Operating effectiveness
- Continuous evidence required
Trust Services Criteria
Five categories, one place for each
Security is required. Add the others your customers ask for.
SecurityRequiredCommon Criteria CC1–CC9. Required for every SOC 2 report.
- Access control and MFA
- Change management
- Risk assessment
- Incident response
- Vendor management
AvailabilityOptionalSystems are available as committed.
- Capacity monitoring
- Backups and restores
- Disaster recovery drills
ConfidentialityOptionalConfidential information is protected.
- Data classification
- Encryption
- Secure disposal
Processing integrityOptionalProcessing is complete, accurate and timely.
- Input and output checks
- Error handling
- Change control
PrivacyOptionalPersonal information is handled as committed.
- Consent
- Rights requests
- Retention
Continuous evidence
Every day of the observation period, already proven
Connectors run every day against rules mapped to SOC 2 criteria. A failing check drafts a finding for a person to review, and the fix is recorded with the date, so the auditor sees a continuous record instead of a scramble at the end.
- AWS, Azure, Google Cloud, GitHub, Okta, Intune and more
- Each result filed against CC6, CC7 or CC8 automatically
- Drift and its fix kept side by side
| Rule | Criterion | Last 90 days |
|---|---|---|
| OKTA-002 MFA for all users | CC6.1 | 90 / 90 |
| GH-001 Branch protection | CC8.1 | 88 / 90 |
| AWS-007 CloudTrail all regions | CC7.2 | 90 / 90 |
| INT-001 Disk encryption | CC6.7 | 90 / 90 |
Already on ISO 27001?
Most of the work is already done
ISO 27001 and SOC 2 overlap heavily. Map your ISO controls to the SOC 2 criteria once, and the same evidence counts for both, so the second framework starts mostly complete.
Inside the report
What a SOC 2 Type II report contains
Your buyers will read it section by section. Here is where each part comes from.
Independent service auditor's report
The CPA firm's opinion on whether your controls were designed and operated effectively.
Clean evidence makes a clean opinion more likely.
Management's assertion
Your signed statement that the system description is accurate.
Built from your control set and scope.
System description
Your services, infrastructure, people, data and the boundaries of the audit.
Assets, vendors and integrations export as the starting draft.
Criteria, controls and tests
Each control mapped to a criterion, how the auditor tested it, and any exceptions.
Daily connector results show every day of the period.
Other information
Optional context such as planned fixes for exceptions.
CAPA records give the auditor your remediation plan.
The route
From kickoff to report in four phases
Readiness
Gap assessment against the criteria
Gap assessment against the criteria
Remediate
Policies, controls and connectors
Policies, controls and connectors
Observe
3–12 months of daily evidence
3–12 months of daily evidence
Audit
The CPA firm tests the period
The CPA firm tests the period
Report
Share it from your Trust Center
Share it from your Trust Center
Questions
SOC 2, answered
Who issues the SOC 2 report?
A licensed CPA firm. CompliLens prepares you, runs the observation period and gives the auditor the evidence they request.
How long should the observation period be?
Three to twelve months is common. Many companies start with three to six months for a first Type II report.
Can we do Type I first?
Yes. Many teams get a Type I report while their Type II observation period runs.
Which criteria should we include?
Security is required. Add availability, confidentiality, processing integrity or privacy based on what your customers ask for.