Question 1

What is SOC 2?

Accepted Answer

SOC 2 (Service Organization Control 2) is a trust and security assurance framework developed by the AICPA. It assesses how service organisations protect customer data based on Trust Services Criteria covering Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Question 2

Who needs SOC 2?

Accepted Answer

SOC 2 is relevant for service organisations that handle customer data, particularly SaaS providers, cloud service providers, technology vendors, and managed service providers. It is typically required by mid-market and enterprise customers as part of vendor due diligence.

Question 3

What are the Trust Services Criteria?

Accepted Answer

The Trust Services Criteria (TSC) are the core principles used in SOC 2 engagements: Security (mandatory), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select criteria based on their services, contractual commitments, and risk profile.

Question 4

What is the difference between Type 1 and Type 2?

Accepted Answer

SOC 2 Type 1 assesses whether controls are suitably designed at a specific point in time. SOC 2 Type 2 evaluates both design and operating effectiveness of controls over a defined period, typically 3-12 months, providing higher assurance.

Question 5

What evidence is required?

Accepted Answer

SOC 2 requires documented policies and procedures, operational evidence including system configurations, access control records, logging outputs, incident records, and change management artefacts demonstrating consistent control operation over the audit period.

Question 6

How does Basenorm support SOC 2?

Accepted Answer

Basenorm supports SOC 2 by providing a control-first, continuous assurance platform with unified control mapping, centralised evidence collection, governance workflows, and real-time readiness dashboards for Type 1 and Type 2 audits.

Question 7

Does SOC 2 overlap with other frameworks?

Accepted Answer

Yes, SOC 2 shows significant overlap with ISO/IEC 27001, GDPR security requirements, NIS2, DORA, and BIO2. Control domains like access control, logging, incident management, and risk management are conceptually equivalent across these frameworks.

SOC 2 Compliance for Trust Services Criteria

Automated Mapping for All Trust Services Criteria

Trust Services Criteria

Type 1 vs Type 2 Comparison

Continuous SOC 2 Readiness

Unified Governance and Monitoring

Auditor Evidence Package

Frequently Asked Questions