SOC 2 Compliance Management

The core checklist. All AICPA Trust Service Principles are listed here — Security (CC1–CC9), Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P1–P8). Updated for 2026 to include AI/ML governance, zero trust network access, SBOM, IaC security scanning, SIEM platforms, EDR deployment, ransomware response playbooks, tabletop exercises, DDoS mitigation, phishing simulation programs, board-level security governance, multi-state US privacy law compliance, breach notification timelines, and cross-border data transfer mechanisms.

• Click a principle to expand its criteria and individual requirements.
• Check off each requirement you have implemented.
• Click any requirement to open a detail panel where you can add notes or create a linked task.
• Use the Report Type filter to see only the controls relevant to your target SOC type.
• Use the search bar to find specific controls quickly.

A visual overview of your compliance progress across all principles. Shows percentage completion per Trust Service Principle so you can see at a glance where you are strong and where gaps exist.

• Progress bars per principle update in real time as you check off requirements.
• Overall compliance score shown as a single percentage.
• Use this view to prioritize which areas need the most work.

A lightweight task tracker for compliance work items. Create tasks for any requirement, assign them to team members, set due dates, and track completion.

• Add tasks manually or create them directly from a requirement in the Assessment tab.
• Tasks include a title, description, assignee, and due date.
• Mark tasks complete or delete them as you progress.

Generate audit-ready reports based on your current checklist state. Four report types are available, plus a SOC certification path tracker.

• Compliance Summary — snapshot of your overall and per-principle progress.
• Gap Analysis — lists all incomplete requirements grouped by principle with recommendations.
• Evidence Checklist — itemized list of evidence artifacts to collect, with collection frequency.
• Audit Readiness — weighted readiness score with targeted recommendations.
• All reports can be exported as PDF. Your full dataset can be exported as JSON or CSV.
• The SOC Path Tracker lets you mark progress through the certification journey steps for SOC 1, SOC 2, and SOC 3.

Comprehensive reference material to help you understand which SOC report type fits your situation and what auditors look for.

• Interactive decision guide: answer four questions to find the right SOC report for your organization.
• Side-by-side comparison table for SOC 1, SOC 2, and SOC 3.
• 2026 Emerging Compliance Areas panel covering AI/ML governance, zero trust, software supply chain, and cloud-native security.
• Detailed descriptions of each SOC type with audience, focus, and examples.