Security
The starter family ReadyComply instantiates per system. Access, change, and operations you can actually show.
Frameworks · SOC 2
Readiness is the work. The report is a firm.
SOC 2 is an independent examination by a licensed CPA. ReadyComply is the register you keep so that examination is not a scavenger hunt. It does not issue the report.
What SOC 2 is
Type I is a point in time. Type II is a period.
A Type I report describes controls at a date. A Type II report tests them over a window. Software cannot skip that. A platform can only keep the criteria, evidence, policies, and gaps in one place while you run the period.
Trust Services Criteria
Security is the common starting set.
Availability, confidentiality, processing integrity, privacy
In scope only if you claim them. Do not instantiate a criterion you will not evidence.
System boundary
The report is about a system, not a logo. Name the products, infra, and vendors that are in.
Not applicable is a statement
Out of scope needs a reason. Empty is not a reason.
The cycle
What ReadyComply holds for a first SOC 2.
- 01
Name the entity and the systems.
Legal name, Authio organization, system boundary.
- 02
Instantiate Security criteria.
Assign owners. Write how each control operates here.
- 03
File evidence by hand.
Date it. Hash it if you can. Link it to the control.
- 04
Open tasks for gaps.
Owner, due date, trail. Close them in the register.
- 05
Bring your own CPA.
ReadyComply is not the firm and does not pick one for you.
In the workspace
The SOC 2 register is these pages.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Also in the catalog
ISO 27001, HIPAA, and GDPR sit on the same system.
Start the register before you hire the firm.
Sign in. Name the first system. Instantiate Security. That is the beginning of a SOC 2, not the end of one.
Sign in