Get audit-ready for SOC 2
SOC 2 Type II · Service Organization Control Report
Trust service criteria for security, availability, processing integrity, confidentiality, and privacy of a service organization's system.
SOC 2What is SOC 2?
Trust service criteria for security, availability, processing integrity, confidentiality, and privacy of a service organization's system.
Who it applies to
Service organisations, typically SaaS, asked by North American customers to evidence how they safeguard customer data. Usually a sales prerequisite rather than a regulatory one.
How the standard is organised
Built on the Trust Services Criteria. Security is mandatory; availability, processing integrity, confidentiality and privacy are included only if you scope them in. A Type II report covers a period of operation rather than a point in time.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
SOC 2 on the Bitkosh platform
The 61 SOC 2 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- A1.2Authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections
Provide environmental safeguards and backup measures such as power, cooling, fire protection and data backups.
Availability - CC8.1Authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes
Manage changes through documented request, testing, approval and release steps, including emergency changes.
Security - CC7.3Evaluates security events to determine whether they could or have resulted in a failure to meet objectives
Review security events to judge whether they are real incidents and how serious their impact is.
Security - P8.1Implements a process for receiving, addressing, resolving, and communicating privacy complaints and disputes
Run a process to receive, investigate, resolve and report back on privacy complaints and disputes.
Privacy - P4.2Retains personal information for no longer than necessary to fulfill purposes identified in the notice
Keep personal information only as long as needed for stated purposes or required by law, then remove it.
Privacy - PI1.4Implements policies and procedures to make available or deliver output completely, accurately, and timely
Deliver system outputs to the right recipients accurately, in full and within agreed timeframes.
Processing Integrity
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes SOC 2, and who does it apply to?
How is SOC 2 conformance demonstrated?
How is SOC 2 structured?
Ready to get audit-ready for SOC 2?
See how the Bitkosh Readiness Platform gets you audit-ready for SOC 2 — and the other 47 ready frameworks — from a single control library.