SOC 2 · AICPA Trust Services Criteria
SOC 2 on the controls you already have.
A SOC 2 report shows your customers how your controls perform against the Trust Services Criteria. With Basenorm you reuse your ISO 27001 controls and evidence for SOC 2, on one control library.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- Attestation reportIssued by an independent CPA firm, not a certificate
- Criteria
- Trust Services CriteriaSecurity, plus optional availability, processing integrity, confidentiality and privacy
- Report
- Type I or Type IIDesign at a point in time, or operation over a period
- Often asked by
- North American customersAs part of vendor due diligence
01 / What SOC 2 covers
What SOC 2
looks at.
You choose the Trust Services Criteria that fit your services. Security is always in scope.
- 1Security
Protection against unauthorised access. The common criteria, always in scope.
- 2Availability
Your system is available for operation and use as committed.
- 3Processing integrity
Processing is complete, valid, accurate and authorised.
- 4Confidentiality
Information designated as confidential is protected.
- 5Privacy
Personal information is collected, used and disposed of as committed.
- 6System description
A description of your system and its boundaries, which the report covers.
02 / With your ISMS
SOC 2 on what you already have.
| Topic | Your ISO 27001 ISMS | What SOC 2 adds |
|---|---|---|
| Controls | Annex A controls | Mapping to the Trust Services Criteria and their points of focus |
| Evidence | Evidence for your ISMS | Evidence of operation over the full audit period for Type II |
| Scope | ISMS scope | A system description agreed with your auditor |
| Monitoring | Internal audit and management review | Ongoing monitoring of controls during the period |
Many ISO 27001 controls also count for SOC 2. Whether they meet the criteria is assessed by your auditor.
03 / The assessment
AICPA TRUST SERVICES CRITERIAHow SOC 2
is assessed.
SOC 2 is a report by an independent auditor, not a certification. The report goes to your customers, usually under a non-disclosure agreement.
Read about ISO 27001Design. The auditor assesses whether controls are suitably designed at a point in time.
Operating effectiveness. The auditor tests whether controls operated effectively over a period of several months.
Restricted use. You share the report with customers and partners, usually under a non-disclosure agreement.
SOC 2 is a framework of the American Institute of Certified Public Accountants (AICPA).
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also count for SOC 2.
02Governance Graph
Connect systems, controls, evidence and owners within your SOC 2 scope.
03AskNorman
Ask what is still open for SOC 2, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
SOC 2.
SOC 2 or ISO 27001?
Both look at information security. ISO 27001 is a certifiable management system, used worldwide and widely in Europe. SOC 2 is an attestation report that North American customers often ask for. Many controls can serve both.
Is SOC 2 a certification?
No. SOC 2 is a report in which an independent CPA firm gives its opinion on your controls.
What is the difference between Type I and Type II?
Type I looks at the design of your controls at a point in time. Type II also tests whether they operated effectively over a period.
Does Basenorm perform the SOC 2 audit?
No. Basenorm helps you organise controls and evidence. The audit is performed by an independent CPA firm.
Book a demo
Reuse your ISO 27001 for SOC 2.
In a demo we look at your scope, your controls and what SOC 2 adds.
- Which ISO 27001 controls count for SOC 2.
- How you collect evidence for a Type II period.
- How you manage both on one library.
Hosted in the Netherlands. Your data stays in the EU.