SOC 2

Key requirements

What SOC 2 requires.

• ✓CC — Common Criteria (Security, mandatory)
• ✓Availability criteria (if in scope)
• ✓Confidentiality criteria (if in scope)
• ✓Evidence collection for Type II audit period
• ✓Vendor and risk management

SOC 2 (AICPA Trust Services Criteria)

Select applicable Trust Services Criteria, define scope, map controls to criteria.

Implement controls, collect evidence continuously across the audit period.

Maintain operational cadence: recurring checks, vendor reviews, access reviews.

Build the audit pack, manage auditor requests, track observations and remediation.

SOC 2 Type I evaluates whether controls are suitably designed at a point in time. Type II evaluates whether controls operated effectively over a period (typically 6-12 months). Acuna supports both but is optimized for continuous Type II evidence collection.

Unlike point-in-time tools, Acuna's Operate pane maintains a continuous operational rhythm: recurring control checks, evidence collection, and vendor reviews, so you're always audit-ready.

Yes. SOC 2 Common Criteria and ISO 27001 Annex A share significant overlap. Acuna's cross-framework mapping reuses evidence across both standards.

Acuna supports all five Trust Services Criteria: Security (CC), Availability (A), Processing Integrity (PI), Confidentiality (C), and Privacy (P). Most organizations scope Security as the baseline.

Vendor risk management under SOC 2 CC9.2 is handled by Supplier Shield inside Acuna: vendor assessments, risk ratings, and ongoing monitoring in one place.