SOC 2 is an auditing framework developed by the AICPA that reports on a service organization's controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.

What is the difference between SOC 2 Type I and Type II?

A Type I report evaluates the design of controls at a single point in time, while a Type II report evaluates both the design and the operating effectiveness of those controls over a period, typically three to twelve months.

What are the Trust Services Criteria?

The five Trust Services Criteria are Security (the required Common Criteria), Availability, Processing Integrity, Confidentiality and Privacy. Security is mandatory; the others are included based on the services in scope.

How does SBCMSP help with SOC 2?

SBCMSP continuously monitors the Common Criteria controls it covers, scores each as pass, partial or fail on every scan, auto-collects timestamped evidence, and produces a white-label, audit-ready report for the client and auditor.

All frameworks

AICPA Trust Services Criteria

SOC 2 compliance for MSPs managing SaaS clients

Official source: AICPA Trust Services Criteria

Automate Trust Services Criteria assessments — continuous CC-control monitoring, white-label audit-ready reports and evidence collection from one dashboard.

Get started Read the checklist

SOC 2 Type II · assessment CC 18 / 21

CC6.1Logical & physical access controlsPASS

CC6.6Logical access boundary protectionPASS

CC6.7Encryption in transitPASS

CC7.2Anomaly & event detectionPARTIAL

CC8.1Change managementPASS

CC9.2Vendor & risk assessmentFAIL

SOC 2 is one of ten frameworks mapped from a single scan

SOC 2

HIPAA

PCI DSS v4

NIST CSF 2.0

CMMC

ISO 27001

CIS v8

FTC Safeguards

Cyber Essentials

NIST 800-171

Coverage

How SBCMSP maps SOC 2

Continuous monitoring across every control family — 21 controls monitored, scored on each scan.

Common Criteria (CC)

Security — the foundational TSC every SOC 2 report covers.

Availability

Uptime, monitoring and disaster-recovery controls.

Confidentiality

Data classification, encryption and access restriction.

Processing Integrity

Complete, accurate, timely and authorized processing.

Privacy

Collection, use, retention and disposal of personal data.

Evidence & reporting

Auto-collected evidence and a white-label, audit-ready PDF for every control.

Who it’s for SaaS providers, MSPs and any vendor whose customers ask for a SOC 2 report.

Resources Start with the SOC 2 checklist, then read our guide to external attack surface management.

Continuous, not point-in-time

Audit-ready all year — not just at renewal

Instead of a frantic evidence scramble before the audit, SBCMSP monitors each SOC 2 control continuously and flags drift the moment it happens.

Control-level pass / partial / fail status
Auto-collected, timestamped evidence
Gap remediation guidance per control
White-label report for the client & auditor

readiness · acme-corp86%

Controls passingCC 18 / 21

Evidence collected94%

Open gaps2

Keep exploring

Other frameworks we map

HIPAA PCI DSS NIST CSF CMMC ISO 27001 CIS v8 FTC Safeguards Cyber Essentials CIS Controls

Get your clients SOC 2-ready faster

Run a readiness assessment in minutes and see exactly which controls need work.

Get started Read the checklist