International
SOC 2 compliance, made simple
SOC 2 is an American Institute of CPAs (AICPA) framework built around the Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy. It's the report enterprise buyers most often ask SaaS vendors for before signing a contract.
ComplianceDesk gives you 36 pre-built SOC 2 controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving SOC 2 compliance stops being a spreadsheet exercise.
Every SOC 2 control, organised for you
The real control library ComplianceDesk seeds the moment you activate SOC 2 — 36 controls across 5 categories.
Security (Common Criteria)
- SOC2-1.1 Logical and physical access controls implemented
- SOC2-1.2 System operations monitored for anomalies
- SOC2-1.3 Change management process for system changes
- SOC2-1.4 Risk assessment process performed periodically
- SOC2-1.5 Board and management oversight of security (CC1.1-CC1.3)
- SOC2-1.6 Commitment to competence and accountability (CC1.4-CC1.5)
- SOC2-1.7 Internal communication of security objectives (CC2.1-CC2.2)
- SOC2-1.8 External communication of commitments (CC2.3)
- SOC2-1.9 Security event detection and incident response (CC7.2-CC7.4)
- SOC2-1.10 Vulnerability management programme (CC7.1)
- SOC2-1.11 Vendor and business partner risk management (CC9.2)
- SOC2-1.12 Business continuity and disaster recovery planning (CC9.1)
- SOC2-1.13 Ongoing and separate evaluations of controls performed (CC4.1)
- SOC2-1.14 Control deficiencies evaluated and communicated (CC4.2)
- SOC2-1.15 Control activities selected and developed to mitigate risk (CC5.1)
- SOC2-1.16 General controls over technology developed (CC5.2)
- SOC2-1.17 Control activities deployed through policies and procedures (CC5.3)
- SOC2-1.18 Recovery from identified security incidents implemented (CC7.5)
- SOC2-1.19 Logical access security software, infrastructure and architectures implemented (CC6.1)
- SOC2-1.20 New user registration and authorization controlled (CC6.2)
- SOC2-1.21 Access authorized, modified and removed based on roles and least privilege (CC6.3)
- SOC2-1.22 Physical access to facilities and protected assets restricted (CC6.4)
- SOC2-1.23 Logical and physical protections discontinued at end of asset use (CC6.5)
- SOC2-1.24 External threats to system boundaries defended against (CC6.6)
- SOC2-1.25 Transmission, movement and removal of information restricted (CC6.7)
- SOC2-1.26 Prevention, detection and response to malicious software implemented (CC6.8)
Availability
- SOC2-2.1 System capacity monitored
- SOC2-2.2 Backup and recovery procedures tested
- SOC2-2.3 Environmental protections for infrastructure
Processing Integrity
- SOC2-3.1 Data processing accuracy and completeness controls
- SOC2-3.2 Processing monitored for completeness and accuracy exceptions
Confidentiality
- SOC2-4.1 Confidential information identified and protected
- SOC2-4.2 Secure disposal of confidential information
Privacy
- SOC2-5.1 Personal information handling aligned with privacy notice
- SOC2-5.2 Choice and consent for personal information collection
- SOC2-5.3 Third-party disclosure of personal information controlled
Frequently asked questions
How many controls does ComplianceDesk track for SOC 2?
36, organised into 5 categories, ready to assign to an owner as soon as you activate the framework.
Can I track SOC 2 alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up SOC 2 in ComplianceDesk?
Activating SOC 2 instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
- CSA STAR: Cloud Security Certification Explained →
- How to Run a Vendor Risk Assessment (With a Practical Template) →
- HIPAA Compliance for SaaS Vendors: What Business Associates Actually Need to Know →
- SOC 2 Type I vs Type II: What's the Difference, and Which Do You Need? →
- ISO 27001 Certification: A Step-by-Step Guide to the Process →
Other International frameworks
See your full compliance picture
131 frameworks, one system of record.