SOC 2 Type 2, no exceptions.
The #1 reason Type 2 audits fail is missing evidence for some month in the audit window. Continuous evidence collection from Okta, AWS, Datadog, Snyk, GitHub — every day of every month, mapped to the right Common Criterion automatically. Started your reporting period? You're already auditing.
- All 5 TSC: Security · Availability · PI · Confidentiality · Privacy
- Type 1 readiness through Type 2 observation period
- Evidence collected continuously from your existing tools
- Cross-mapped to ISO 27001, HIPAA, NIST CSF, PCI DSS
What is SOC 2 compliance software?
Type 2 evidence captured year-round, not in a 6-week prep sprint. RiskWatch covers all 5 trust services criteria with 100+ Common Criteria, tracks per-customer CUEC attestation that determines whether your report is evidence or theatre, and bridges to ISO 27001 / HIPAA / GDPR on the same control library. The CPA firm signing the report sees the evidence; sales sees the report; customers see the trust center.
Most Type 2 audits don't fail loudly. They fail in the “exceptions” section of the report.
SOC 2 auditors and compliance leads we asked were unanimous about the three failure modes — and they're not what most teams worry about. The rare catastrophic failures get the attention; the routine pile-up of exceptions is what actually weakens the report.
Started your Type 2 reporting period too early. Month 1 is full of exceptions.
The reporting period should start the day controls are fully implemented and operating effectively — not the day you decide to start. Type 1 readiness gates the Type 2 reporting period. The platform recommends a start-date once Common Criteria are 100% green and have been operating for 30 days clean.
You did the access review. You didn't screenshot it. Auditor says you didn't.
The most-cited Type 2 failure mode: “we did it but can't show you.” If the evidence isn't captured, the control didn't operate — even if it actually did. Continuous evidence pulls daily from Okta, AWS, Datadog, Snyk, GitHub, Jira. Every access review, every approval, every change ticket auto-mapped to the Common Criterion that needs it.
Former employees still have prod access. Auditors find this in 30 seconds.
Access drift is the silent Type 2 killer — orphaned accounts, MFA gaps, shared credentials. Type 2's 6-12 month window catches every one. Quarterly access reviews automated from Okta/AD with attestation tracking. Drift flagged before the auditor finds it.
Every module a SOC 2 program needs — in one platform.
Sixteen modules sharing the TSC library, evidence vault, and audit trail. Built around the Type 2 observation period so evidence accumulates continuously, not in monthly screenshot bursts.
TSC progress at a glance
Per-TSC compliance %, top open exceptions, evidence freshness, days-in-observation, auditor-meeting status.
All 5 categories pre-loaded
Security (CC1–CC9), Availability (A1), Processing Integrity (PI1), Confidentiality (C1), Privacy (P1–P8).
From your existing tooling
Okta, AWS, Azure, Datadog, Snyk, GitHub, Jira — evidence pulls daily, mapped to controls automatically.
Design effectiveness in 8 weeks
Assessment workflow walks Common Criteria-by-Common Criterion. Gaps tracked to remediation tasks with due dates.
365 days, automatically
Track every control's operating effectiveness across the observation period. Exception flagging at the moment of breach.
By TSC, by criterion, by period
AICPA-aligned export bundles evidence for the CPA firm. Drilldown from criterion to source log/screenshot/ticket.
Exceptions → tracked work
Exceptions convert to tasks with owner, due date, evidence-of-close. Bidirectional Jira/ServiceNow sync.
Subservice organizations
Track subservice org SOC 2 reports, complementary user-entity controls (CUECs), and inclusive vs carve-out treatment.
CC6.1 · CC6.2 · CC6.3
Automated quarterly access reviews from Okta/AD with attestation tracking. Evidence captured per review cycle.
CC7 incident response
Security incidents from your SIEM auto-create CC7 evidence records. Closure workflows with post-incident reviews.
SOC 2 + ISO 27001 + HIPAA + PCI
Each TSC criterion maps to ISO 27001 Annex A, HIPAA §164, PCI DSS requirements. One evidence set, multiple audits.
All SOC 2-required policies
12 policies covering CC1 governance, CC2 communications, CC5 control activities. Attestation tracking per policy version.
CC1.1 · CC1.4 evidence
Onboarding, training, periodic re-attestation tracked per employee. Auditor sees a per-person training history.
In-scope systems mapped
Sync from ServiceNow/Lansweeper to keep the in-scope system inventory current. Auto-tag SOC 2 boundary.
"Who closed CC7.2?" answered instantly
Timestamped log of every control score, evidence upload, exception transition. CPA-admissible for SOC 2 review.
Quarterly cadence per TSC
Quarterly access reviews, monthly anomaly review, daily log review — cadences automated per Common Criterion.
Security · Availability · PI · Confidentiality · Privacy.
Most SOC 2 vendors cover Security only. RiskWatch covers all five Trust Services Categories from day one — including the new 2017 TSC Privacy criteria (P1–P8) and the 2022 Common Criteria refinements. The auditor sees the full picture, the customer sees a comprehensive report, and you score once across all categories.
- Security (CC1–CC9) — Common Criteria covering control environment, risk assessment, control activities, monitoring
- Availability (A1) — Capacity planning, environmental protections, recovery procedures
- Processing Integrity (PI1) — Inputs, processing, outputs, retention — relevant for FinTech and processors
- Confidentiality (C1) — Information designated as confidential, retention, destruction
- Privacy (P1–P8) — Notice, choice, collection, use, retention, access, disclosure, quality, monitoring
SOC 2 + ISO 27001 + HIPAA + PCI.
Every Common Criterion maps to ISO 27001 Annex A controls, HIPAA §164 sections, and PCI DSS requirements. One evidence set satisfies multiple audits — SaaS teams typically run SOC 2 alongside ISO 27001, plus HIPAA for healthcare verticals or PCI DSS for payment flows. RiskWatch flags overlap and conflicts.
- ISO 27001:2022 Annex A — CC6.1 → A.5.16, CC7.2 → A.8.16, CC8.1 → A.8.32 — full crosswalk pre-built
- HIPAA Security Rule — for healthcare SaaS — CC6.1 ↔ §164.312(a), CC7.2 ↔ §164.308(a)(1)(ii)(D)
- PCI DSS v4.0.1 — for payment SaaS — CC6.1 ↔ Req 8.3, CC7.2 ↔ Req 10.4
- NIST CSF 2.0 — TSC criteria mapped to Govern, Identify, Protect, Detect, Respond, Recover
- GDPR (privacy TSC) — P1–P8 cross-mapped to GDPR Articles 5–35
From design effectiveness to operating effectiveness.
Design of controls — 'are the controls properly designed?' One-day audit. Typical: 8–12 weeks readiness.
Operating effectiveness — 'do the controls work?' 6–12 month observation. Typical: ongoing.
9 categories shared by all SOC 2 reports — CC1 through CC9 covering the security TSC
A1, PI1, C1, P1–P8 — added to the report based on which TSCs the org pursues
Your Type 2 report relies on customers performing controls.
Complementary User Entity Controls are the controls your customers must perform for your SOC 2 report to be meaningful. Most SaaS providers list CUECs in the report and never check whether customers actually perform them. When a customer's auditor pulls your SOC 2 and asks “did you do CUEC-2?”, your customer's answer determines whether your report is useful or theatre. The CUEC tracker captures attestation per customer, per cycle.
- Per-customer CUEC inventory — every CUEC tied to every contract; customers see their own list in their portal
- Annual attestation cycle — auto-routed reminders; customers attest with timestamp + auditor for the audit log
- Gap-to-coverage tracking — % of customers attested per CUEC; auditor sees the rolled-up status in the Type 2 evidence pack
- CSA STAR alignment — CUEC inventory cross-mapped to CSA STAR shared-responsibility matrix
From Type 1 readiness to Type 2 audit in five stages.
Most teams complete Type 1 readiness in 8–12 weeks. The 6–12 month Type 2 observation period runs continuously after that. Stage 5 is on-demand the moment your CPA firm needs evidence.
Scope and select TSC
Decide which TSC categories apply (Security mandatory; the others optional). Sync CMDB to identify in-scope systems.
Type 1 readiness
Score each Common Criterion. Map controls. Close design gaps. Type 1 audit: design effectiveness as of a single date.
Type 2 observation
Continuous evidence collection from existing tooling. Each control's operating effectiveness tracked across the period.
Auditor walkthrough
AICPA-licensed CPA firm reviews evidence by TSC and Common Criterion. Exceptions flagged, root-caused, remediated.
Type 2 report issued
AICPA-format SOC 2 Type 2 report with management assertion, system description, control mapping, and operating-effectiveness opinion.
The Type 2 audit that stopped requiring a war room.
Real SaaS teams. Real Type 1-to-Type 2 timelines. Real auditor sign-offs without screenshot scrambles.
Continuous evidence collection from Okta, Snyk, and Datadog meant our Type 2 observation period was already 90% audited the day we started.
“We pursued SOC 2 + ISO 27001 simultaneously. Cross-mapping cut the second audit's prep time by 60% — same evidence, two reports.”
“Subservice org tracking caught two of our Tier 1 vendors with expired SOC 2 reports before our auditor did. We avoided a CUEC finding.”
“Adding the Privacy TSC felt impossible until we saw P1–P8 already mapped to our existing GDPR work. Same controls, same evidence, second category in-scope.”
Plus every framework SaaS teams run alongside SOC 2 — cross-mapped.
Score one TSC criterion, satisfy ISO 27001, HIPAA, PCI DSS, NIST CSF, and GDPR simultaneously. The same evidence becomes the same audit deliverable, multiple times.
Take RiskWatch home before you sign anything.
Three downloads. Use them to evaluate, share with your CPA firm, or build the SOC 2 readiness business case.
SOC 2 Readiness Checklist
Thirty-two pages walking through Common Criteria CC1 through CC9 plus the Availability, Processing Integrity, Confidentiality, and Privacy criteria. Includes an evidence-collection guide per criterion.
- All 5 TSC categories
- Per-criterion evidence guide
- Type 1 → Type 2 transition plan
SOC 2 to ISO 27001 Crosswalk
Every Common Criterion mapped to its ISO 27001 Annex A counterpart. Use as a control-mapping reference if you're running both audits, or as a migration source if you're evaluating which to start with.
- CC1–CC9 ↔ Annex A mapping
- Conflict-flag column
- Implementation guidance per row
SOC 2 Platform Buyer's Guide
Vendor scorecard, Vanta-vs-Drata-vs-RiskWatch comparison, evidence-automation depth, multi-framework support, pricing by org size.
- Feature matrix · 6 vendors
- Continuous-evidence comparison
- Pricing benchmarks
Common questions, answered up front.
About SOC 2 Type 1 vs Type 2, the Trust Services Criteria, continuous evidence, CUECs, and cross-framework mapping — and how RiskWatch covers all of them.
What is SOC 2 compliance software?
What's the difference between SOC 2 Type 1 and Type 2?
Which Trust Services Criteria do I need?
How is SOC 2 different from ISO 27001?
How does continuous evidence collection work?
What are CUECs and how does the platform handle subservice orgs?
How does cross-framework mapping reduce audit cost?
Is there a free trial?
Start your Type 1 readiness this week.
Start a 30-day free trial — every TSC category, all Common Criteria, continuous evidence integrations, Type 2 observation tracking, and cross-framework mapping. No credit card required.
No credit card required · 30-day free trial · Cancel anytime