SOC 2
System and Organization Controls 2
System and Organization Controls 2, an AICPA attestation report. An independent CPA firm gives an opinion on a service organization’s controls for security and, optionally, availability, processing integrity, confidentiality and privacy, the Trust Services Criteria. A Type 2 report covers how the controls operated over a period; a Type 1 report covers their design at a point in time.
Covered in
SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test
What a SOC 2 report covers, which Trust Services Criteria engineering owns (CC6 logical access, CC7 system operations, CC8 change management), the controls that meet them in a modern pipeline, and how to export a complete change population for a Type 2 period.
ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers
Distinguish management systems, technical controls, risk outcomes, independent reports and government cloud requirements before reusing evidence.
Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use
Connect supplier claims to product scope, supported versions, release integrity and vulnerability handling before making a procurement decision.
Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA
Keep one set of release-bound engineering evidence (SBOM, provenance, review records, scan results, ASVS results and vulnerability handling) and map it to several frameworks: a worked crosswalk, an evidence index checked in CI with a CSV export, and an OSCAL component definition.
ISO 27001 secure development: Annex A 8.25 to 8.33 as engineering practice and evidence
How ISO/IEC 27001:2022 treats secure development, what the Annex A development controls (8.4, 8.8, 8.9 and 8.25 to 8.33) look like as engineering practice, and how to keep the Statement of Applicability and its evidence honest with checks in code.