SOC 2, the evidence the auditor asks for
The controls and the proof that they have run continuously, collected week by week and not pieced together the day before the visit.
A market requirement, not a legal one
SOC 2 is an attestation standard developed by the American Institute of CPAs (AICPA). It is requested above all by US and international customers of service providers, particularly software and cloud providers, before entrusting them with their data.
Unlike ISO standards, the outcome is not a certificate: it is a report by an independent auditor that describes the controls and judges their effectiveness. For a European company selling software abroad it is often the condition for being able to bid.
If you have already worked on ISO/IEC 27001, you start at an advantage: a good part of the controls overlap.
Trust Services Criteria and Type I or Type II reports
The controls are organised on the five Trust Services Criteria. Security is always included; the others are chosen according to the service provided.
- Security: protection against unauthorised access and changes
- Availability: the service operates as agreed
- Processing integrity: processing is complete, accurate and authorised
- Confidentiality: protection of information designated as confidential
- Privacy: collection, use and retention of personal data
- Type I: the controls are well designed, at a specific point in time
- Type II: the controls have worked throughout an observation period
- Evidence for every control, for the whole period
SOC 2 Type II: continuity that documents itself
The difference between Type I and Type II is continuity, and that is where companies get stuck: nobody kept the proof. Dottor Box keeps it as it works.
| SOC 2 need | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the Trust Services Criteria, on coverage and maturity |
| Continuity of controls | Time Machine: a calendar of the last 180 days and a technical report archived every week, on Wednesday night |
| Vulnerability management | Vulnerability Assessment with versioned history and comparison between periods |
| Logical access | Microsoft Entra ID, Google Workspace and Access logs |
| Risk and suppliers | Risk Assessment and Supply Chain |
| Incidents | Incident Response and Data Breach with phases and owners |
| Availability and continuity | Business continuity: BIA, continuity plan and backup checks |
| Staff awareness | Training with the record of completed courses |
The observation period is already documented
Criteria assessed
A self-assessment on the Trust Services Criteria so you know where to start.
Proof over time
The dates come from what was actually carried out, not from the work queues.
Gaps you can see
Months with no activity are not hidden: you see a gap in coverage before the auditor does.
Reports ready to hand over
The technical report for every week, downloadable month by month.
When the auditor arrives there is no need to reconstruct six months of controls: they are already in the archive, each with its date.
SOC 2: frequently asked questions
SOC 2 or ISO 27001: which is better?
It depends on who is asking. US customers often ask for SOC 2, European ones for ISO/IEC 27001. The controls overlap to a large extent: the work done for one also serves the other.
How long is the observation period for a SOC 2 Type II?
You agree it with the auditor; periods of a few months are common. What matters is having evidence for the whole period, and that is what the Dottor Box history keeps.
Does Dottor Box replace the auditor?
No. The SOC 2 report is issued by an independent auditor. The platform helps you prepare, understand where the gaps are and hand over evidence that is organised and dated.
The modules that work for SOC 2
Time Machine
The calendar of checks from the last 180 days and the archive of weekly reports.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more ProveCyber Risk Report
The periodic report in PDF, presentation and Excel, with the chapters you choose.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.