SOC 2 compliance built onreal security controls.Not checkbox documentation.

The five TSC are Security (required for all SOC 2 reports), Availability, Processing Integrity, Confidentiality, and Privacy. Most organisations pursue Security plus Availability and Confidentiality. The scope of your report is determined by your service commitments to customers.

Achieving an initial Type II report typically takes 9–18 months: 3–6 months to implement controls and build evidence infrastructure, followed by a 6–12 month observation period. Organisations with existing security programmes typically reach readiness faster. Spakto's automated evidence collection significantly accelerates both phases.

SOC 2 requires continuous evidence of control operation: access reviews, vulnerability scan reports, penetration test results, change management records, security training completion logs, incident response logs, and vendor risk assessments. Spakto automates collection and organisation across all these categories.

Type I assesses whether your controls are suitably designed at a point in time. Type II assesses whether those controls are operating effectively over a defined observation period — typically 6–12 months. Type II provides significantly stronger assurance and is required by most enterprise buyers.

Both certifications are valuable but serve different audiences. ISO 27001 is the primary standard for European and global markets. SOC 2 is required by most US enterprise customers and SaaS buyers. The two standards share significant control overlap — achieving one accelerates the path to the other.

CC6 (Logical & Physical Access) consistently shows the most gaps: inadequate MFA coverage, missing privileged access reviews, and undocumented deprovisioning. CC7 (System Operations) is second — organisations often lack documented incident response procedures or anomaly detection. CC3 (Risk Assessment) gaps appear when risk registers are informal or not updated annually.