SOC 2 — Trust Services Criteria
Voluntary standard for service organizations covering Security, Availability, Processing Integrity, Confidentiality, and Privacy. Assessed by a licensed CPA firm.
Governing Body
AICPA
Audit Type
CPA / 3rd Party Attestation
Certification
Report (not a certificate)
Renewal
Annual (Type II)
Primary Audience
B2B SaaS / Cloud Providers
Continuous Control Monitoring
Real-time evidence collection across CC6, CC7, CC8 (Security, Change Mgmt, Risk). Automated alerts on control drift.
Evidence Collection & Repository
Automatically aggregates logs, access reviews, vendor documents, and policies into a centralized audit-ready library.
Policy Library & Version Control
Prebuilt SOC 2-aligned policy templates. Track attestation, approvals, and annual reviews.
Vendor Risk Management
Third-party risk assessments mapped to CC9 (Risk Mitigation). Automated questionnaire flows and scoring.
Access Review Automation
Periodic user access reviews with workflow approvals. Evidence auto-attached to CC6.2 and CC6.3.
Readiness Assessment & Gap Analysis
Pre-audit gap scoring across all 5 Trust Services Categories with remediation task tracking.
Incident Management Tracking
Incident log with severity tagging mapped to CC7.3–CC7.5. Requires integration with your ticketing system.
Penetration Test Management
Upload and track pentest reports; findings linked to controls. Does not execute tests natively.
CPA Audit Relationship
The final SOC 2 report is issued by a licensed CPA firm. CriticalMatrix facilitate evidence delivery but cannot replace the auditor.
Scope Definition & System Description
The System Description (Section III of the report) must be authored by management and reviewed by auditors.
Subservice Organization Carve-Outs
Decisions on carve-out vs. inclusive methods require legal/management judgement.
Supported Integrations
- AWS, Azure, GCP (cloud config)
- Okta, Azure AD (access logs)
- GitHub, Jira (change management)
- Slack, Teams (comms evidence)
- HR platforms (employee training)
CriticalMatrix Perspective
SOC 2 is our most mature module. Customers typically reduce audit preparation time by 60–70%. Our advisory program produces a formatted evidence package your auditor can consume directly.
Recommended CriticalMatrix Stack
Reference stack for SOC 2 Type II readiness across the five Trust Services Criteria. Partners produce the auditable evidence; CriticalMatrix maps controls to your auditor's request list.
Security & Access (CC6)
MFA, conditional access, privileged access, identity recovery, and lifecycle controls for non-federated SaaS generate the bulk of CC6 evidence.
Change & Risk Monitoring (CC7, CC8)
EDR, vulnerability scanning, ASPM correlation, and continuous offensive validation evidence support CC7.1 and CC7.2.
Logging & Incident Response (CC7.3, CC7.4)
24x7 SOC, alert triage, and documented IR runbooks satisfy detection and response criteria.
Availability & Recovery (A1)
Immutable backups and tested restore procedures address availability commitments.
Confidentiality & Data (C1)
Data classification, DLP, and communications retention satisfy confidentiality criteria.
API & Application Security
API discovery, runtime protection, and ASPM cover product surfaces examined during SOC 2 audits.
Partners listed contribute evidence and capabilities aligned to this framework. Tooling alone does not produce certification — assessment by a qualified auditor or C3PAO is still required.
Need a readiness assessment for SOC 2?
A CriticalMatrix advisor can map your current state to the controls above in a single working session.