Automate SOC 2 readiness with adaptive compliance

SOC 2 reports are performed under American Institute of CPAs (AICPA) professional standards. 

Put simply, SOC 2 evaluates an organization's security controls. Specifically, this framework evaluates your controls across five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy. 

Most startups start with just Security and add the others (like Availability or Confidentiality) later, depending on what their customers request.

Your management will make an assertion about the controls, and an independent CPA firm will issue their opinions. This is commonly called an audit, but it is technically an examination. 

The output of a SOC 2 engagement is a SOC 2 report. Reports are typically shared with customers and prospects under NDA, and name the scope and period they cover.

Outcomes of a SOC 2 engagement are not binary pass/fail. The CPA firm issues an opinion, which is either unmodified or modified.

• Unmodified (clean) — the most common outcome, and the one you want.
• Qualified — a specific matter is significant enough to call out, but not pervasive to the report as a whole.
• Adverse — deficiencies are both material and pervasive. This can relate to the fairness of the system description, the suitability of control design, the operating effectiveness of controls, or any combination.
• Disclaimer — the auditor could not obtain enough evidence to form an opinion at all.

Importantly, a Type II report can contain test exceptions and still receive an unmodified opinion. Exceptions are documented in the report, and what determines the opinion is their significance and pervasiveness — not their existence. So a clean opinion does not mean a flawless report, and a handful of exceptions does not mean you failed.

A modified opinion is commercially damaging, but you do not technically "fail" a SOC 2.

No, there is no government law requiring SOC 2. However, it is contractually mandatory for many enterprise buyers. Without it, you will likely fail vendor security assessments or get blocked by procurement teams.

Think of Type I as a snapshot photograph and Type II as a continuous video.

• Type I tests if your security controls are designed correctly on a specific date.
• Type II tests how effectively those controls operated over a window of time (usually 3 to 12 months). Enterprise buyers usually demand a Type II report.

A SOC 2 report covers a specific historical window, and buyers typically consider it valid for 1 year from the end of the audit period. A Bridge Letter (or Gap Letter) is a document you sign covering the gap between the end date of your last report and the start of your new audit cycle, reassuring buyers that your controls haven't lapsed.

No compliance software can issue a final SOC 2 report. A SOC 2 examination must be performed by an independent, licensed CPA firm, under AICPA professional standards.

Our platform acts as the engine room—it connects to your systems, automatically gathers the evidence, manages your policies, and hands it over to the auditor on a silver platter to save you time and money. If you would like to work with one of the auditors that we partner with, please reach out to your rep.