SOC2ReadinessGuide:TrustServicesCriteriaandPreparation

What is SOC 2?

SOC 2 is an attestation report issued about a service organization's controls, prepared under the American Institute of CPAs (AICPA) Trust Services Criteria (TSC). The report describes the system and the controls the auditor examined; it is not a certificate issued to the company. SOC 1 covers controls relevant to financial reporting, while SOC 2 addresses controls over security and the other trust services categories a customer or auditor selects.

Who a SOC 2 report is for

A SOC 2 engagement is scoped to the system that delivers a service to customers. Organizations that commonly obtain SOC 2 reports include SaaS and cloud service providers, managed service providers, data centres and technology providers that handle customer data. Whether a report is required, and which categories it covers, is a matter for the customer contract, the vendor risk process and the auditor's engagement scope. The AICPA Trust Services Criteria are the authority for the criteria themselves; your auditor determines the report's scope and opinion.

Trust Services Criteria

The AICPA Trust Services Criteria define five categories. Security (the Common Criteria, CC1–CC9) is included in every SOC 2 engagement. Availability, Processing Integrity, Confidentiality and Privacy are included when the engagement selects them.

Common Criteria (CC1–CC9)

The Security category is organised into nine Common Criteria in the AICPA TSC:

• CC1 — Control environment
• CC2 — Communication and information
• CC3 — Risk assessment
• CC4 — Monitoring activities
• CC5 — Control activities
• CC6 — Logical and physical access controls
• CC7 — System operations
• CC8 — Change management
• CC9 — Risk mitigation

Type I and Type II reports

Under the AICPA SOC 2 attestation standards, a Type I report addresses whether controls were suitably designed and implemented at a specified point in time. A Type II report also addresses operating effectiveness over a period stated in the report. The period, the system boundary and the criteria are agreed with the auditor for the engagement; they are not fixed by the TSC.

Preparing for a SOC 2 engagement

The work below is preparation guidance, not an audit opinion or a certification process. Your auditor decides the scope, testing approach and conclusion.

1. Agree the scope

• Define the system boundary: applications, infrastructure, data flows and supporting services.
• Select the Trust Services categories the engagement will cover, with the auditor and the customer commitments in view.
• Agree the report type and the period with the auditor.

2. Map controls to the criteria

• Map existing controls to the applicable TSC criteria and identify gaps.
• Record the control description, owner, frequency and the evidence that shows the control operated.
• Keep the mapping under review as the system changes.

3. Operate and evidence the controls

• Run the controls over the period the report will cover, not only before the audit starts.
• Keep evidence linked to the control and the criterion it supports.
• Record exceptions and how they were remediated.

4. Work with the auditor

• Agree the evidence request list and the point of contact for the engagement.
• Provide evidence for the sample selections the auditor makes.
• Record findings and management responses in the report process.

How Compliance Enablers supports SOC 2

Compliance Enablers runs SOC 2 as one of 30 standards live as guided programmes, each following the platform's scoping → assessment → scoring → evidence → readiness method. Controls, evidence and findings map across standards through curated crosswalk mappings, so evidence collected once counts everywhere it applies. SOC 2 is a licensed standard: it opens only after the customer confirms in-app that they hold their own licence, and the platform records that confirmation. The platform works alongside your own licensed copy of the standard; we never sell or redistribute standard text.

Risk, controls, audit, evidence, document, vendor and incident modules run in the same platform as the SOC 2 programme. Sage runs as 18 domain agents across the platform — evidence, policy, questionnaire, risk, control, audit, vendor, incident, regulatory, privacy, training, ESG, SOX, AI governance, CISO copilot and DPO advisor — and every AI action is metered and visible to the customer. The free readiness comparison shows how far an existing programme already covers another standard through the crosswalks; it does not assert that one framework satisfies another.