SOC 2 Type II
SOC 2 is an auditing framework developed by the AICPA that evaluates an organization's controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type II reports assess the operational effectiveness of these controls over a period of time.
Covered Controls
Controls that have explicit mappings to SOC 2 requirements.
Govern (6 controls)
Identify (6 controls)
Protect (21 controls)
Detect (6 controls)
Respond (5 controls)
SOC 2 vs Other Frameworks
SOC 2 provides 100% coverage of the 49 cybersecurity controls tracked by ControlMap. NIST CSF 2.0 covers 100%, ISO 27001 covers 100%, CIS v8 covers 90%, PCI DSS covers 100%, CMMC covers 94%, 800-53 covers 100%, HIPAA covers 94%, GDPR covers 96%. For maximum coverage, organizations often combine SOC 2 with complementary frameworks to address gaps in areas like niche domains.