SOC 2 readiness

SOC 2, run as a programme. Not a scramble.

A plan, an owner for every control, evidence an auditor accepts.

Shape your SOC 2 planBook a walkthrough
Type II window open
74 of 128 controls passing
Auditor invited
5Trust Services Criteria, with Security always in scope
9series of common criteria, CC1 to CC9
2report types, Type I and Type II
1plan, from scoping to renewal
Why SOC 2

Enterprise buyers ask for the report before they sign.

SOC 2 is an independent attestation, from a CPA firm, on how a service organisation protects customer data. It is how a vendor proves it, instead of promising it.

01

The report is a gate

Many buyers will not onboard a vendor until they have read its report.

02

Questionnaires repeat

The same security questions arrive from every buyer. A standing programme answers them once.

03

Renewal is annual

A Type II report covers a period, so the work continues after the first report.

The journey

From scoping to a clean report, one continuous plan.

Seven stages, with the same plan and the same people from the first day to renewal.

  1. 01

    Scope

    Choose the system, the criteria and the report type.

    A plan built from the SOC 2 framework
  2. 02

    Assess gaps

    Compare what you do today with what the criteria expect.

    Gaps recorded against each control
  3. 03

    Remediate

    Close the gaps, write the policies, name the owners.

    Tasks with owners and due dates
  4. 04Type II observation window

    Operate

    Run the controls and keep evidence as you go.

    Evidence linked to every control
  5. 05

    Fieldwork

    Your auditor tests controls and samples evidence.

    A shared workspace for the auditor
  6. 06

    Report

    An independent CPA firm issues the SOC 2 report.

    Issued by your auditor, not by us
  7. 07

    Maintain

    Stay ready between audits and renew each period.

    Review cadence and standards watch
Criteria

Every criterion, accounted for.

Security is mandatory. Add Availability, Processing integrity, Confidentiality or Privacy when your customers' needs call for them. Your plan carries whichever you choose.

SOC 2one programmeSecurityCC1 to CC9Always in scopeAvailabilityA1Uptime and recoveryProcessing integrityPI1Complete, accurate, timelyConfidentialityC1Protected as agreedPrivacyP1 to P8Personal information
  • SecurityCC1 to CC9 · Always in scope
  • AvailabilityA1 · Uptime and recovery
  • Processing integrityPI1 · Complete, accurate, timely
  • ConfidentialityC1 · Protected as agreed
  • PrivacyP1 to P8 · Personal information
Control map

From criterion to control to evidence.

The common criteria for Security, and how each is carried in your plan. Additional criteria follow the same pattern when they are in scope.

CriteriaWhat auditors look forIn CyberMetric GRCEvidence kept
CC1Control environmentGovernance, ethics and accountabilityPolicy library with owners and approvalsApproved policies, role definitions
CC2CommunicationResponsibilities communicated inside and outPolicy publishing and acknowledgementsAcknowledgement records
CC3Risk assessmentRisks identified, scored and treatedRisk register with a live heat mapRisk assessments, treatment plans
CC4MonitoringControls evaluated on an ongoing basisProgramme dashboard and internal auditAudit results, findings, closures
CC5Control activitiesControls selected, owned and testedControls mapped to the framework planControl tests, owner sign-off
CC6Logical and physical accessAccess granted, reviewed and removedAccess controls with scheduled evidenceAccess reviews, joiner and leaver records
CC7System operationsDetection and incident responseIncident response controls and tasksIncident records, tabletop results
CC8Change managementChanges authorised, tested and approvedChange controls with evidence requestsApproved change records
CC9Risk mitigationVendors and continuity managedVendor oversight and continuity controlsVendor reviews, recovery tests
Plan builder

Shape your SOC 2 plan in three choices.

A quick view of where to start. A named expert refines it with you in the first conversation.

What do you need most?
Where are you today?
Which criteria will customers expect? Security is always included.
The programme

See your SOC 2 programme on screen.

The same screens your compliance lead, your control owners and your auditor would use.

Swipe the screen sideways to see all of it.

Programme dashboard. Framework progress, risk heat map, upcoming milestones and standards updates for the whole programme.

Evidence

How a control becomes evidence an auditor accepts.

Auditors sample evidence. Your programme should make every sample easy to find, verified and tied to a criterion.

  1. 1Control assignedEvery control has an owner and a review date.
  2. 2Task raisedThe owner sees what to provide, and by when.
  3. 3Evidence addedDocuments and records attach to the control.
  4. 4ReviewedA reviewer verifies it before the auditor sees it.
  5. 5MappedEvidence links to the criteria it supports.
  6. 6SharedThe auditor works in an isolated, shared workspace.
Type I and Type II

Two reports. One programme underneath.

Enterprise buyers usually prefer Type II. Many teams start with Type I to reach a first report sooner, and run the same plan into Type II.

Type IAre the controls suitably designed, at a point in time?
Design at a date
Type IIAre the controls designed well and do they operate effectively, over a period?
Design and operation over the period, commonly 3 to 12 months
Time
Working with us

A flagship engagement, not a login.

Software carries the plan. People carry you through it.

  1. 01

    Readiness assessment

    A gap assessment against the criteria in scope, with a prioritised plan.

  2. 02

    Programme set-up

    Your SOC 2 plan, owners and policies configured alongside your team.

  3. 03

    Operating cadence

    Regular reviews of evidence and open tasks with your named expert.

  4. 04

    Auditor liaison

    Help organising fieldwork and answering evidence requests with your auditor.

  5. 05

    Renewal planning

    A plan for the next period, updated for any change to the criteria.

What we do not do.We do not issue SOC 2 reports. An independent CPA firm does. We prepare you, and work alongside the firm you choose.
Also on your list?

Facing the DPDPA as well?

Many teams carry both. Consent, rights requests and data mapping sit in CyberMetric DPDPA, next to the same evidence habits you build for SOC 2.

CyberMetric DPDPA

Consent, data principal rights, data discovery and lineage.

Explore CyberMetric DPDPA →
Keep going

Where to next?

Pick a path. Each one takes a minute or two, and ends with a clear answer.

  1. ✓Explore
  2. 2Self-check
  3. 3Talk to us
1Shape your SOC 2 planThree choices and a suggested path, with an owner for each step.2See CyberMetric GRCRisks, controls, audits and policies in one place.3Take the 1-minute DPDPA checkSix questions. See your score and your biggest gaps straight away.
Your first meeting

See your SOC 2 plan, before you commit.

Tell us a little and we will arrange a conversation with the people who build and support it.

What we will cover

  1. Your customers' requirements and your timeline
  2. Which criteria are in scope
  3. A walkthrough of a SOC 2 plan, risk and evidence
  4. A clear next step, with no obligation

Helpful to bring

  • The systems in scope
  • Any customer requests for a SOC 2 report
  • Your target date for the report

Request a meeting

Email this request

Nothing is sent from this page. The button opens your email app, or copy the request and send it to reachout@cybermetriclabs.com. Privacy Notice

Independently assured
ISO/IEC 27001Information security management
SOC 2 Type IIControls tested over time

Need the certificate or report for your vendor review? Ask us.

Book a walkthrough

See it against your requirements.

Ask for a walkthrough, a pilot or a fit check for your regulator, your sector and your data.