What Is This Module For?
The SOC 2 module helps SaaS companies and technology service providers prepare for and manage their SOC 2 Type II audit — the leading security compliance standard required by US and EU enterprise customers.
What Is SOC 2?
SOC 2 is an auditing standard developed by the American Institute of CPAs (AICPA). It evaluates an organisation's controls related to security, availability, processing integrity, confidentiality, and privacy (the Trust Services Criteria). Type II covers a 6–12 month observation period — stronger than Type I which is point-in-time.
Step-by-Step Guide
- Go to SOC 2 in the sidebar.
- Select your Trust Services Criteria — Security is mandatory; add Availability, Confidentiality, etc. based on customer requirements.
- Complete the readiness assessment — 100+ controls mapped to the selected criteria.
- Assign controls to owners and set implementation deadlines.
- Upload evidence for each control — policies, configuration screenshots, audit logs.
- Track your overall readiness percentage before engaging an auditor.
Common Mistakes to Avoid
- Starting SOC 2 prep 2 months before the audit — Type II requires 6–12 months of evidence collection. Start at least 12 months before you need the report.
- Not having written policies — SOC 2 auditors require documented, approved, and communicated policies. Verbal policies do not count.
Frequently Asked Questions
Q: Does dcomply issue the SOC 2 report?
A: No. The SOC 2 report is issued by a licensed CPA firm after an independent audit. dcomply helps you prepare for and manage the audit evidence collection process.