SOC 2 compliance software for evidence, controls, and audit readiness.
Reach your SOC 2 report with every control, policy, risk, and piece of evidence in one Sable workspace, and keep it current for the next one. Built for founders, IT leads, and compliance managers at B2B companies preparing for a first or renewing examination.
- One workspace for controls, evidence, policies, risks, and vendors
- Evidence attached to the controls it proves, reused across frameworks
- A readiness number you can show an auditor before the observation period starts
14 days · No credit card
Talk to SubRosa about readiness →Sable's framework readiness table with SOC 2 selected; the multi-factor authentication control opened to show the SOC 2 criteria it satisfies; its evidence tab with expiry dates and one item twelve days from lapsing; the reminder sent to its owner and what readiness would fall to if it lapsed.
SOC 2 requirements start with the Security category of the Trust Services Criteria.
The AICPA defines SOC 2 through the Trust Services Criteria. Security is in scope for every SOC 2 examination; the other four categories are added when your customers or your service call for them. Most organizations begin with Security and extend scope on a later report.
- SecurityRequired in every SOC 2 examination. Access control, change management, logging, and incident response live here.
- AvailabilityAdd it when customers depend on uptime commitments.
- Processing IntegrityAdd it when your service transforms or calculates customer data.
- ConfidentialityAdd it when contracts restrict how data is used and shared.
- PrivacyAdd it when you collect personal information under your own privacy notice.
SOC 1 covers controls relevant to your customers' financial reporting. SOC 2 covers the Trust Services Criteria. SOC 3 is a general-use summary of a SOC 2 report that you can publish.
SOC 2 Type I tests control design and Type II tests controls over time.
Type I
Evaluates whether your controls are suitably designed at a point in time. Readiness work for a Type I means every control in scope is defined, has an owner, and has initial evidence attached before the examination date.
Type II
Examines whether those controls operated effectively across an observation period. Readiness work for a Type II means evidence keeps arriving on schedule and gaps are closed and recorded as they appear, for the whole period.
An independent licensed CPA firm performs the examination and issues the SOC 2 report. Sable prepares you for it and holds the evidence the firm examines; it does not replace the auditor.
A SOC 2 readiness assessment turns compliance gaps into a remediation plan.
A readiness assessment compares your current controls with the criteria in scope and records what is missing: controls that do not exist yet, policies weaker than the control they support, evidence nobody collects, and work with no owner. In Sable each gap becomes a finding with an owner, a due date, and a link to the control it affects, so the remediation plan is the same list the auditor later sees closed.
SubRosa can run the assessment for you. See readiness support →
SOC 2 compliance checklist
Define the audit scope
Which systems, locations, and teams the report covers.
Choose Trust Services Criteria categories
Security, plus any category your customers require.
Run a risk assessment
Record the risks each control exists to treat.
Document policies and procedures
Written, approved, and acknowledged by the people they govern.
Assign control owners
One accountable person per control.
Collect evidence
Attach it to each control, with the date it stops being current.
Remediate gaps
Track each finding to closure, with proof.
Select an independent CPA firm
Agree the report type and the observation period.
Sable organizes SOC 2 audit evidence, controls, and owners in one workspace.
Frameworks, controls, policies, evidence, risks, vendors, and findings sit on one record. The features below all work on that record.
Readiness holds between audits because evidence expires and owners get reminded.
Between a Type I and the next Type II, the risk is drift: a policy nobody re-approved, a screenshot from last year, a control whose owner left. Sable dates every piece of evidence, queues what is about to lapse, reminds the owner, and recomputes readiness when something expires, so a gap shows up in the queue before it shows up in an examination.
Expiring-evidence queue
Every evidence item carries a date it stops being current. The queue lists what lapses next, and readiness shows what it would fall to.
Ownership changes
Reassign a control and its findings, tasks, and reminders move with it. Nothing is left owned by someone who has gone.
Remediation tracking
Findings stay open until the fix is recorded with proof. The next observation period begins with the closures already on the record.
Connected systems
Hourly checks from Microsoft Entra ID attached to the controls they prove, so some evidence stays current without a hand on it.
Add SubRosa specialists when your team has no compliance staff.
SubRosa's compliance team, testers, and vCISO advisors work in the same Sable workspace as you. Choose the help you need; the controls, evidence, and findings stay in your workspace either way.
- Readiness assessmentFormer auditors assess your controls against the criteria in scope and leave you a gap list in Sable, each item with an owner and a due date.
- AdvisoryA named vCISO advisor runs the program with you: the policy set, the risk assessment, control owners, and the auditor relationship.
- Testing and monitoringPenetration testing and the managed SOC, run by SubRosa analysts, produce evidence for the Security criteria inside the same workspace.
Reach your SOC 2 report with evidence that is already in order.
Open a workspace with no credit card and no sales call, map the Security criteria to the controls you already run, and read your readiness number. Add SubRosa when you want people on it.
Common questions
- Is SOC 2 a certification?
- No. SOC 2 ends in an attestation report issued by an independent licensed CPA firm, not a certificate. The report describes your controls and gives the auditor's opinion on them. Customers read the report; there is nothing to display beyond a statement that you have one.
- Does Sable replace my SOC 2 auditor?
- No. Only an independent licensed CPA firm can perform a SOC 2 examination and issue the report. Sable holds the controls, evidence, and findings the firm examines and exports them in the shape the firm asks for. SubRosa can prepare you for the examination; it does not issue the report.
- What can we share with a customer before our report is issued?
- Share your scope, your readiness status, and the policies you have approved, under NDA where appropriate. Do not describe yourself as SOC 2 compliant or imply a report exists before the CPA firm issues it. Many customers accept a readiness summary and a target date while a Type II observation period runs.
- Do we need all five Trust Services Criteria categories?
- No. Security is required; the other four are included only when your service or your customers call for them. Most first reports cover Security alone, sometimes with Availability. Add categories on a later report once the controls for them are operating.
- How long does a first SOC 2 Type II report take?
- Plan for readiness work, then an observation period, then the examination itself. Observation periods commonly run from three to twelve months, and many first-time organizations choose a shorter one and extend it on the next report. Readiness time depends on how many controls already exist and are documented, which is what the readiness assessment tells you.
- What happens after the report is issued?
- The report covers a fixed period, so the next one starts immediately. Keep evidence arriving on schedule, close findings as they appear, and record ownership changes, so the next observation period begins with controls already operating. Sable's expiring-evidence queue and readiness number show that drift before the auditor does.