Security always, the rest if you commit to it
The common criteria CC1 to CC9 are part of every report. Availability, Confidentiality, Processing Integrity and Privacy are added when you make commitments to customers in those areas.
AICPA · Trust Services Criteria 2017 (2022 revision)
Walk into your SOC 2 audit prepared.
Your US customers are asking for a SOC 2 report and you're not sure where to start. Audexa takes you through all 61 criteria, tells you what the CPA auditor will look at and what evidence you need over the period, and turns every gap into a task with an owner.
- 61 Trust Services Criteria
- Security + the categories you choose
- Evidence for Type I and Type II
SOC 2 readinessType II
64%
ReadinessSample data
- CC1–CC2 Control environment and information78%
- CC3–CC5 Risk, monitoring and control activities66%
- CC6 Logical and physical access58%
- CC7–CC9 Operations, change and vendors61%
- A1 Availability52%
61 Trust Services Criteria with guidance on what the CPA auditor checks
135 SOC 2 ↔ ISO 27001 mappings to reuse answers
111 SOC 2 ↔ NIST CSF 2.0 mappings
5 languages: English, Spanish, French, Italian and German
What SOC 2 is
SOC 2 isn't a certificate. It's a report signed by a CPA auditor.
A SOC 2 report describes your system and gives an independent auditor's opinion on your controls, measured against the AICPA Trust Services Criteria. US customers in particular ask for one before signing with a SaaS or service provider.
Type I: design at a point in time
The auditor checks that controls are designed and in place on a given date. It's the usual first step if you've never had a report.
Type II: operation over a period
The auditor samples across an agreed period and asks for proof that each control worked. A missing acknowledgement or a skipped access review becomes an exception.
System description
Management describes the service, its boundaries, infrastructure, people and data. That description is part of the report and has to match what the auditor sees.
Complementary user entity controls (CUECs)
Some responsibilities sit with your customers, such as managing their own users or turning on MFA. The report lists them, so they should be clear and published.
Subservice organizations
If you rely on AWS, Azure, GCP or other providers, you decide whether they stay out of scope (carve-out) or in (inclusive) and collect their own SOC 2 reports.
Sources: AICPA & CIMA, publisher of the Trust Services Criteria
How Audexa helps
From "a customer wants our SOC 2" to a plan you can show the auditor.
A guided questionnaire, criterion by criterion, with what the auditor expects, connected to tasks, policies and evidence.
Assess
Know which criteria you cover and which you don't.
Report categories
Before you start you choose the categories; Security is always in. The questionnaire only shows the criteria in your report.
CPA auditor guidance
Each criterion explains what the auditor will ask for and what changes between Type I and Type II.
Yes, Partial, No or N/A
Answer control by control and record applicability with a reason.
Prepare
Turn every finding into owned work.
How to meet it
Concrete steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Gaps become tasks with subtasks, an owner and dates.
Starter policies
67 policy templates so you don't start from scratch. 5 are linked to SOC 2: “Information Security Policy”, “Access Control Policy”, “Incident Response Policy”, “Change Management Policy” and “Service Catalogue, Service Level and Capacity Procedure”.
Prove
Have ready what the auditor will ask for.
Evidence vault
Keep the operating evidence for the period next to the criterion it supports.
PDF and Excel report
Score, findings and action plan to share with management or your auditor.
Re-audit
Run the assessment again as you close gaps and compare progress before the report window.
Some features depend on your plan and active modules.
Scoping question
Pick your report categories and only see what applies.
Security (CC1 to CC9) is always included. Add Availability if you offer an SLA, Confidentiality if you sign confidentiality clauses, Processing Integrity if you calculate or transmit critical transactions, and Privacy if you process personal data. You see how many questions your questionnaire will have before you start.
- CC1–CC9: control environment, risk, access, operations, change and vendors
- A1 Availability: capacity, backups and disaster recovery
- C1 Confidentiality and PI1 Processing Integrity
- P1–P8 Privacy: notice, consent, retention, access and breaches
SOC 2 report categoriesScoping
- Security (CC1–CC9)33 criteria · always
- Availability (A1)3 criteria
- Confidentiality (C1)2 criteria
- Processing Integrity (PI1)5 criteria
- Privacy (P1–P8)18 criteria
Type I and Type II
What evidence the auditor will ask for, and for how long.
For Type I it's enough to show that the control is designed and working on a date. For Type II the auditor samples the period: joiners and leavers, access reviews, deployed changes, incidents. Each Audexa criterion tells you what sample to expect and what trail you need to keep.
- Which document or record the auditor asks for in each criterion
- What Type I needs and what Type II adds
- Common mistakes that end up as exceptions
- Expected evidence and closure criterion per control
CC6.2 User provisioning and removalType II
- Approved joiner and leaver procedureDesign · Type I
- Sample of leavers in the periodOperation · Type II
- Access removed on time2 cases with no record
- Suggested ownerIT / HR
Already ISO 27001?
Build on what you already have for ISO 27001 and NIST CSF.
When you create the SOC 2 audit, Audexa estimates how much your other audits already cover. Answers with a high-coverage mapping arrive as proposals marked "Review it" and a person confirms them. They aren't automatic equivalences: the CPA auditor will still test your controls.
- 135 mappings to ISO/IEC 27001:2022
- 111 mappings to NIST CSF 2.0
- "How much does what I have cover?" before you start
- Only high coverage proposes a "Yes", and someone always reviews it
SOC 2 ↔ ISO 27001 mappings135 pairs
- CC6.3 ↔ A.5.15 Access controlHigh coverage · Yes proposed
- CC7.2 ↔ A.8.15 LoggingHigh coverage · Yes proposed
- CC1.1 ↔ A.6.2 Terms of employmentPartial coverage · no proposal
- Proposed answer"Review it" · a person confirms
How it works
Three steps to meet the auditor with your homework done.
Set the scope
Choose the report categories, see how much your existing work covers and mark the applicability of each criterion.
Assess with auditor guidance
Answer criterion by criterion knowing what evidence the CPA will ask for in Type I and Type II.
Close gaps and collect evidence
Assign tasks, approve policies, store the period's evidence and rerun the assessment before the audit.
Plans
SOC 2 is included from the Premium plan.
The Free and Core plans don't include SOC 2. Pricing depends on the size of your team: we give you a fixed proposal in the demo.
Premium
RecommendedTo prepare for SOC 2 with a small team.
- SOC 2 and the other new frameworks in 1.6.1
- 10 audits a month and 3 users
- Policies, evidence, tasks and re-audits
- PDF and Excel reports and the Aude assistant
- 200 assets per section
Diamond
For several frameworks and teams without limits.
- Unlimited audits and users
- Everything in Premium
- Unlimited assets
- vRadar: CVE exposure of your inventory
Before and after
Preparing SOC 2 in spreadsheets vs. in Audexa.
AreaWithout a platformWith Audexa
Scope
Unsure which categories to include
Scoping question with Security always in
What the auditor wants
Found out at the first meeting
Type I and Type II guidance in every criterion
Gaps
Lists with no owner or date
Tasks with subtasks, owner and closure criterion
Period evidence
Screenshots scattered across folders
Evidence vault linked to each criterion
ISO 27001
Redoing the work from scratch
135 reviewable mappings
Frequently asked questions
What people usually ask us about SOC 2.
Does Audexa issue the SOC 2 report?
No. Only an independent CPA auditor can issue a SOC 2 report. Audexa helps you prepare: a guided self-assessment, an action plan and organized evidence for when the audit begins.
What's the difference between SOC 2 Type I and Type II?
Type I assesses the design of your controls on a specific date. Type II also assesses that they operated over a period, using samples from that period. Audexa explains in each criterion what evidence each one needs.
Which categories should my report include?
Security is always in. The others (Availability, Confidentiality, Processing Integrity and Privacy) are added if you have commitments to customers in those areas. In Audexa you choose them before the questionnaire and only see the criteria that apply.
We already have ISO 27001. Does it help with SOC 2?
It's a good starting point. Audexa has 135 mappings between SOC 2 and ISO 27001 and shows you how much they cover before you start. Answers arrive as proposals for a person to review, and the CPA auditor will still test the controls.
What are CUECs and subservice organizations?
CUECs are controls your customers must operate on their side, such as managing their users. Subservice organizations are providers you depend on, such as your cloud. Audexa guides you to document both and choose between carve-out and inclusive.
Which plan do I need for SOC 2?
SOC 2 is available on the Premium and Diamond plans. Free and Core don't include it. In the demo we look at which plan fits your team.
Request a demo
See how you'd prepare your SOC 2 in Audexa.
In a 30-minute demo we walk through the category scoping, the auditor guidance per criterion and the action plan.
- We review which categories make sense for your report.
- We show how much your ISO 27001 work already covers.
- We explain which plan fits your team.