SOC 2 compliance software
What it is
SOC 2 is an attestation report built on the AICPA Trust Services Criteria. A licensed CPA firm examines a company's controls and issues the report. Every SOC 2 report includes the Security criteria. The other four are optional: availability, processing integrity, confidentiality and privacy. A Type 1 report tests the design of controls at one point in time. A Type 2 report tests whether those controls worked over an observation period, usually three to twelve months.
Who needs it
No law requires SOC 2. Service organizations that store or process customer data ask for it, usually SaaS, cloud, data and managed service providers. Enterprise procurement teams and B2B buyers request a current report during vendor reviews. Many security questionnaires point to it. A report from a licensed CPA firm shows a buyer that an independent auditor tested your controls.
What auditors check
- A system description that explains the services in scope, the people, the software and the data flows.
- Written security policies that management reviews and approves on a set schedule.
- Access controls that give each user only the access the job needs, reviewed regularly and removed at exit.
- Two step sign in on the systems that hold customer data.
- Change management that approves, tests and records each change before it reaches production.
- Logging and monitoring that record security events and alert the team to unusual activity.
- Risk assessments that list threats, rate them and track the treatment of each one.
- Vendor reviews for the subservice organizations you rely on, with their reports on file.
- Incident response plans, with records of drills and of each incident handled.
- Backup and recovery tests, with records that show the results.
How Oncrypt gets you ready
Oncrypt builds your SOC 2 readiness from the controls auditors test first. Our scans cover your website and its trackers. We also check your email and domain settings and the cloud accounts where customer data lives. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps each control record ready for your auditor. A licensed CPA firm performs the SOC 2 audit and issues the report. Oncrypt gets you audit ready for that review.
Overlap with other frameworks
Questions
What is SOC 2?
SOC 2 is an attestation report from a licensed CPA firm. It tests your controls against the AICPA Trust Services Criteria. Buyers read the report to judge how you protect their data.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report tests whether controls are designed correctly at one point in time. A Type 2 report tests whether they operated effectively over an observation period, usually three to twelve months. Most enterprise buyers ask for Type 2.
Which Trust Services Criteria should we include?
Every SOC 2 report includes the Security criteria. Availability, processing integrity, confidentiality and privacy are optional. Pick the ones that match the promises you make to customers.
Does Oncrypt make us SOC 2 compliant?
SOC 2 is an attestation report. Oncrypt does not issue one. Oncrypt gets you audit ready. A licensed CPA firm performs the audit and issues the report.
How long does SOC 2 readiness take?
It depends on how many systems hold customer data and how mature your controls are. Your score shows each step and the order to take them. Plan for an observation period of several months before a Type 2 report.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.