Are the controls there? Proves controls are appropriately designed and implemented at a single point in time.
Did you consistently operate them? Proves controls operated effectively over an observation period, typically 6–12 months.
Mandatory for every SOC 2 report — the foundation we are scoping to first.
On the roadmap depending on final report scope.
On the roadmap depending on final report scope.
On the roadmap depending on final report scope.
On the roadmap depending on final report scope.
SOC 2 draws on the same control set we're building for ISO 27001 — one control environment, not a separate audit trail:
Targeted once ISO 27001 foundational controls are in place: proves controls are appropriately designed and implemented at a point in time.
Observation period begins after Type I; proves controls operated effectively over a sustained 6–12 month window.
Get our current Trust Services Criteria scope and readiness timeline under NDA.