SOC 2 Control Explorer

How to use it

• Start with Security (CC1 to CC9). Every SOC 2 report includes it; add Availability, Confidentiality, Processing Integrity or Privacy only if a customer contract requires them.
• Mark each criterion Met only when the control is designed, operating and you could hand an auditor dated evidence today. Everything else is Partial or Missing.
• Open “Evidence auditors ask for” under each series before you decide; the question is never “do we do this” but “can we prove it for the whole period”.
• Download the gap list and turn every Partial and Missing row into a ticket with an owner. That list is the readiness project plan.

Reading the criteria

The Trust Services Criteria are written for auditors, not engineers. “What auditors look for” translates each one into the thing the auditor will test; “Common gap” is what we see most often at the first readiness review. Type I tests design at a point in time, so a control that exists on the audit date passes. Type II tests operation across the period: event-driven controls (access grants, changes, incidents) are sampled, typically 20 to 30 events or every event if there were fewer, and periodic controls need evidence for every occurrence in the window.

Does marking everything “Met” mean we will pass?

No. It means you believe you can evidence every criterion. The readiness review tests that belief against actual artifacts before an auditor does. The gap between “we do this” and “we can prove it for twelve months” is where most first audits lose time.

Is my data saved anywhere?

Only in your browser’s local storage. Nothing is sent to us. Use the CSV download to keep a copy or share it with your team.

Can you run the readiness review?

Yes. We do it as a fixed-scope engagement, control by control, with the evidence open, and leave you with the remediation plan and the evidence calendar. Talk to us.