SOC 2
with ComplyEncrypt
SOC 2 is an AICPA attestation framework in which an independent CPA firm reports on a service organization's controls against the five Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity and Privacy. Security is always in scope; the others are selected according to the services provided.
Not available to buy yet. No launch date or price has been announced.
Who this is for
SaaS and technology service providers whose customers request SOC 2 reports
SOC 2 is common in North American sales, while ISO 27001 is expected in many other markets. Teams pursuing both need to see where a single ISO-based ISMS already supplies the controls and evidence, and where SOC 2 asks for something extra.
The requirements
What SOC 2 asks of your organization
Trust Services Criteria
Define the system boundary and select criteria beyond Security, such as Availability, Confidentiality, Processing Integrity and Privacy.
Control design
Describe the system and design controls that meet the selected criteria; a Type 1 report assesses design at a point in time.
Operating effectiveness
Keep evidence that controls operate throughout a review period, which a Type 2 report assesses.
The planned ComplyEncrypt pathway
A structured approach to aicpa trust services criteria
The roadmap pathway is intended to provide a direct comparative analysis of how each Trust Services Criterion maps to an ISO 27001-based ISMS, highlight SOC 2-specific gaps and organize evidence for auditor requests. It is not available to buy yet.
Intended documentation scope
- System description and boundary
- Trust Services Criteria to ISO 27001 mapping
- Control evidence across the review period
- Vendor and risk-assessment records
Your team remains accountable
The roadmap describes intended functionality, not a currently available module. Documents must reflect your real processes. Your team implements controls, verifies evidence and manages ongoing obligations.
Only a licensed CPA firm can issue a SOC 2 report. ComplyEncrypt is not an audit firm and does not perform attestation or guarantee report outcomes.
On the roadmap
Interested in buying SOC 2?
Tell us about your organization and purchase interest. This is an enquiry, not an order, payment or reservation.
Related frameworks
See the product in action.
A 2-minute walkthrough of what you get the moment you buy a framework.