Why SOC 2
Your North American customers are asking for it.
SOC 2 is a framework defined by the AICPA, the American Institute of Certified Public Accountants. North American companies that entrust data to a SaaS vendor expect it.
It is not a certification: an independent audit firm examines your controls and issues an attestation report, which you then share with your customers.
Type I or Type II
Two reports, two levels of rigor.
The Security criterion is always included. Availability, processing integrity, confidentiality and privacy are added depending on your commitments to customers.
SOC 2 Type I
The auditor assesses the design of your controls at a specific point in time. It is often a first step, quicker to obtain.
SOC 2 Type II
The auditor checks that your controls operated over several months. Evidence must be produced and kept throughout the period.
With ISO 27001
Work that is largely shared.
Much of the controls and evidence serves both projects. Nayru's common foundation saves you from doing the same work twice.
With Nayru
Your SOC 2 project, end to end.
In the platform
- SOC 2 criteria, control by control
- The assessment and gap analysis
- AI-assisted documentation
- Evidence linked to each criterion
- A mock audit before the audit firm arrives
Who does what
- Nayru prepares your controls, documents and evidence
- Your teams validate and implement the measures
- An independent audit firm issues the SOC 2 report
For a Type II, the 30 days cover preparation. Then comes the observation period, during which your controls must operate and leave evidence.
SOC 2 FAQ
Your questions about SOC 2.
Is SOC 2 a certification?
No. It is an attestation report issued by an independent audit firm, based on an examination of your controls. You then share it with your customers.
Should we start with Type I?
It is often the simplest: Type I checks the design of your controls at a point in time. Type II, more demanding, comes next over an observation period.
Can we run ISO 27001 and SOC 2 at the same time?
Yes. Much of the controls and evidence is common. Nayru pools them so you don't redo the work.
Does Nayru issue the SOC 2 report?
No. Only an independent audit firm can issue the report. Nayru prepares your controls, documents and evidence.
Let's talk about your SOC 2 project.
A customer is asking for a SOC 2 report? Tell us about your situation and see how Nayru helps you prepare it.