SOC 2

SOC 2 Type I reports on the suitability of control design at a point in time. It answers whether the right controls are designed to meet the selected Trust Services Criteria.

SOC 2 Type II reports on both design and operating effectiveness over a defined period (commonly 3-12 months). It answers whether those controls operated consistently during the audit window.

Most enterprise customers eventually expect Type II. Organisations often start with Type I to establish baseline design, then run a Type II observation period once evidence collection is reliable.

Your report covers one or more criteria categories:

• Security (required baseline) - protection against unauthorised access and disclosure that could compromise systems or data.
• Availability - systems are available for operation and use as committed.
• Processing integrity - system processing is complete, valid, accurate, timely and authorised.
• Confidentiality - information designated as confidential is protected as committed.
• Privacy - personal information is collected, used, retained, disclosed and disposed of in line with commitments and criteria.

Scope decisions matter: in-scope products, environments, locations, subservice organisations and carve-outs all shape the report your customers will read.

A typical SOC 2 readiness programme includes:

Scoping
Agree systems, criteria categories, trust boundaries and whether complementary user entity controls or subservice organisations apply.

Gap assessment
Map current policies, technical controls and operational practices to the selected criteria and common control points (access, change management, logging, incident response, vendor risk, backups).

Remediation
Close design gaps, automate evidence where possible, and define owners for recurring evidence (access reviews, ticket samples, monitoring alerts).

Evidence period
For Type II, operate controls consistently and retain samples your auditor can test.

Auditor engagement
Walkthroughs, sample testing, exception handling and draft report review.

Crossbow helps product and service organisations become SOC 2 ready without turning engineering into a full-time evidence factory:

• Criteria selection and system description support
• Control mapping and gap assessment against Security and optional criteria
• Policy and procedure packs aligned to how your teams ship
• Technical control reviews (identity, cloud config, logging, change and release)
• Vendor / subservice organisation risk guidance
• Evidence calendar and sample readiness for Type II periods
• Remediation advisory through auditor fieldwork

Where you already run ISO 27001 or PCI programmes, we reuse overlapping evidence so SOC 2 does not become a parallel bureaucracy.