SOC 2 Type II
Trust Services Criteria tracked continuously, so the evidence for your next Type II window accumulates instead of being assembled the month before.
What SOC 2 Type II is
SOC 2 is an attestation report produced by a CPA firm under AICPA standards, evaluating a service organisation against the Trust Services Criteria. The Security category — the Common Criteria, CC1 through CC9 — is mandatory; Availability, Processing Integrity, Confidentiality and Privacy are optional categories added according to what you commit to your customers.
The distinction that matters commercially is Type I versus Type II. A Type I report says the controls were suitably designed on a date. A Type II says they operated effectively across a period, typically six to twelve months, and it is the only one enterprise buyers take seriously. That period is the entire reason SOC 2 tooling exists: a Type II auditor samples evidence from throughout the window, so evidence that did not exist until the month before the audit is evidence of nothing.
The Common Criteria are built on the COSO internal control framework, which is why CC1 through CC5 read like governance and organisational design rather than security engineering. Teams that skip straight to CC6 access controls and CC7 monitoring routinely find the COSO-derived criteria are where their first audit stalls.
Who it applies to
- SaaS and technology companies selling to US enterprise buyers, where a SOC 2 Type II is effectively a precondition for procurement.
- Service organisations whose customers depend on them for availability, processing integrity or confidentiality commitments.
- Companies with a signed customer contract containing a SOC 2 obligation and a deadline attached to it.
- Organisations that already hold ISO 27001 and are being asked for a SOC 2 by American customers — the crosswalk makes this materially cheaper than starting over.
How it is structured in CMDash
CMDash seeds the Trust Services Criteria across the Common Criteria and the four optional categories, with the criterion as the unit of assessment. The Common Criteria groups follow COSO — control environment, communication and information, risk assessment, monitoring activities, control activities — before the security-specific groups for logical and physical access, system operations, change management and risk mitigation.
| Control Environment | 5 |
| Communication & Information | 3 |
| Risk Assessment | 4 |
| Monitoring Activities | 2 |
| Control Activities | 3 |
| Logical & Physical Access | 8 |
| System Operations | 5 |
| Change Management | 1 |
| Risk Mitigation | 2 |
| Availability | 3 |
| Processing Integrity | 5 |
| Privacy | 18 |
| Confidentiality | 2 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
AICPA publishes the criteria at no cost but retains copyright, so the criteria text cannot be redistributed inside this product.
CMDash ships the control identifiers, the titles, and its own evidence-requirement guidance. If you hold a licence, you can import the official text yourself through the framework CSV import, which records it as customer-provided.
Download free from AICPA & CIMA →Free to download, but not redistributable
What CMDash does for SOC 2 Type II
- Every criterion tracked with an owner, a status and its own evidence requirement, so the Type II observation window accumulates continuously instead of being reconstructed.
- Seeded crosswalks to ISO 27001:2022 and to both versions of NIST CSF — the practical benefit being that an organisation doing SOC 2 and 27001 together does not run two evidence-collection programmes.
- Dated evidence with a reviewer workflow and timestamps, which is what makes a sampled artefact defensible six months after it was captured.
- An evidence package export — ZIP with manifest, files and data snapshots — for handing the auditor a complete set rather than a shared drive.
- A time-boxed read-only seat for the audit firm, scoped to SOC 2 and expiring on a date you set.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to SOC 2 Type II’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Depth: how controls are evidenced
Control counts
61 controls in 13 groups, read from the same public control catalog that powers the SOC 2 Type II control library. Identifiers and titles only; the text is licensed. 24 have at least one seeded crosswalk to another framework.
How controls are mapped to evidence
CMDash ships mapping suggestions, each a connector and a data type for one control, with the condition it is meant to check. A suggestion appears once a matching connector is connected and applies only when you accept it.
Once accepted, CMDash files a dated evidence record for that control each day while the connector stays connected, recording when it last synced. Only continuous-monitoring rules (a rule pack, or one you write) evaluate a condition and change a control’s status. You can map a connector to any control yourself.
Some suggestions are derived: a pre-built check for a control in another framework is reused here when a direct crosswalk edge between the two controls has confidence of at least 0.85. Derived suggestions are counted separately below and never added to the directly mapped ones.
Connector rules versus attested
Of 61 controls, 5 have a pre-built connector check, mapped by CMDash and not independently reviewed, that contributes evidence, and 2 more have a crosswalk-derived one. The other 54 have no shipped rule and are attested unless you add one. An attested control has an owner, a status, uploaded, dated evidence, and reviewer notes.
- Amazon Web Services: CC6.6, CC7.1 (derived)
- Certn: CC1.4
- Checkr: CC1.4
- GitHub: CC8.1
- GitLab: CC8.1
- Google Cloud Platform: CC6.6
- Google Workspace: CC6.1
- Microsoft Azure: CC6.6
- Microsoft Entra ID: CC6.1
- Okta: CC6.1, CC6.2
- Tenable / Nessus: CC7.5 (derived)
Evidence sources
12 integrations carry data relevant to 6 of the 13 control groups, listed under “Where the evidence comes from” above. You choose which control each signal evidences. Where a control has a shipped rule, its connector is named above.
What CMDash does not do
- CMDash is not a CPA firm and does not issue a SOC 2 report. A licensed CPA firm does.
- CMDash does not reproduce the AICPA’s Trust Services Criteria text. It carries criterion identifiers, titles and its own evidence guidance.
- CMDash does not decide which optional categories are in scope. You decide that with your auditor.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- The AICPA licenses the Trust Services Criteria text. CMDash ships criterion identifiers, titles and its own evidence guidance rather than reproducing the criteria.
- CMDash is not a CPA firm and cannot issue a SOC 2 report. Only a licensed CPA firm can, and any tool implying otherwise is misrepresenting the standard.
- Points of focus — the AICPA's illustrative considerations beneath each criterion — are not seeded as separate rows.
- The optional categories are seeded, but which ones are in scope is a decision you make with your auditor based on your customer commitments; CMDash tracks the scope decision rather than making it.
Common questions
Type I or Type II?
Type II, unless you have a contractual deadline you physically cannot meet — a Type I is a point-in-time design opinion and most enterprise buyers treat it as a placeholder. If you do take a Type I first, the evidence you collect for it is the start of the Type II window rather than throwaway work.
Which categories should we include?
Security is mandatory. Add the others only where you have made a customer commitment that maps to them — an availability SLA, a processing-integrity guarantee, a confidentiality or privacy undertaking. Adding categories you have not committed to is scope you pay for at every audit thereafter.
We have ISO 27001 already. How much carries over?
A great deal of the control substance, very little of the reporting form. CMDash seeds a crosswalk between the 27001:2022 Annex A controls and the Trust Services Criteria, so the overlap is visible per control. What does not carry over is the report itself — a certificate is not an attestation and your American buyers know the difference.
Does CMDash issue the report?
No. A licensed CPA firm does. CMDash holds the evidence across the observation window, packages it, and gives the firm scoped read-only access.
Also in Audit & Attestation
Paid plans cap how many frameworks you run at once, never which ones — SOC 2 Type II is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.