What is SOC 2 certification?
SOC 2 is an attestation report developed by the AICPA that verifies how a service organization protects customer data. It’s assessed against five Trust Services Criteria, Security, Availability, Processing Integrity, Confidentiality, and Privacy, by a licensed CPA firm. Security (the Common Criteria) is mandatory; the others are included based on the services in scope. Strictly speaking there’s no SOC 2 “certificate”, auditors issue an attestation report, but “certification” is how the market refers to it.
What’s the difference between SOC 2 Type I and Type II?
A Type I report evaluates whether your controls are suitably designed at a single point in time. A Type II report evaluates whether those controls operated effectively over a monitoring period, typically three to twelve months. Customers generally prefer Type II because it proves controls work continuously, not just on the day of the audit.
How does Compyl automate SOC 2 compliance?
Compyl connects to your existing stack, cloud, identity, code, endpoint, and HR systems, and collects audit evidence automatically in real time. It maps each artifact to the relevant Trust Services Criteria controls, monitors those controls continuously, flags drift before it becomes a finding, and assigns remediation tasks. The result is a live audit-readiness posture instead of a pre-audit evidence scramble.
How does Compyl score evidence quality?
Compyl 26.2 introduced Evidence Health, which continuously scores every piece of evidence on three dimensions, relevance (does it support the control?), freshness (is it current?), and completeness (does it tell the whole story?). Scoring runs automatically the moment evidence changes and includes an AI summary of exactly what’s missing, so audit gaps surface weeks ahead of an audit instead of during it.
How long does it take to get SOC 2 compliant?
A Type I can often be achieved in a few weeks once controls are in place. A Type II requires a monitoring period, commonly three to twelve months, during which controls must operate effectively. Compyl shortens preparation by automating evidence collection and control monitoring from day one, so the monitoring window is spent maintaining readiness rather than building it.
Can SOC 2 evidence be reused for other frameworks?
Yes. SOC 2 shares the majority of its controls with ISO 27001, HIPAA, NIST CSF, and PCI DSS. Compyl cross-maps every control so a single piece of evidence satisfies each framework it applies to, which is why the second framework costs a fraction of the first.
Did the SOC 2 Trust Services Criteria change in 2025 or 2026?
No. SOC 2 still uses the AICPA’s 2017 Trust Services Criteria with the points of focus revised in 2022. A 2026 AICPA exposure draft proposes changes to the attestation standards (AT-C 105, 205 and 210), not the criteria, and as proposed would apply to engagements beginning on or after June 15, 2029.
Does SOC 2 cover AI systems?
There is no AI-specific Trust Services Criterion. AI features in scope are evaluated under the existing criteria, such as change management, logical access, processing integrity and confidentiality. Organizations that need AI governance assurance often pair SOC 2 with ISO/IEC 42001, the certifiable AI management system standard.
SOC 2 or ISO 27001: which do I need?
SOC 2 is an attestation report from a CPA firm against the AICPA criteria and is what North American buyers usually ask for. ISO 27001 is a certification of your ISMS by an accredited body, valid for three years with annual surveillance, and more common internationally. The controls overlap heavily, so many companies do both.
