SOC 2 in the cloud, criterion by criterion.
Your auditor tests whether controls worked across the whole period, not on the day. NxSCORE checks the cloud side of the Trust Services Criteria every day, and keeps the evidence for the rest with its dates.
You will recognise this if
- A customer asked for your SOC 2 report before they sign, and the audit period has already started.
- Access reviews, change approvals and onboarding records are spread across tools and inboxes.
- Your CNAPP shows the cloud is configured well today, and the auditor asks about the last nine months.
- Evidence is collected in the week before fieldwork, every year.
Where the cloud answers, and where people do.
A CNAPP sees configuration. SOC 2 asks about the whole company, so most criteria need records as well as checks.
| Criteria | Met by | How |
|---|---|---|
| CC1 Control environment | Evidence only | Board oversight, structure, hiring and accountability, shown by records. |
| CC2 Communication and information | Evidence only | Policies communicated inside and outside the company. |
| CC3 Risk assessment | Evidence only | The risk assessment, including fraud and change. |
| CC4 Monitoring activities | Cloud checks plus evidence | Daily assessment of the cloud, plus how deficiencies are reported and fixed. |
| CC5 Control activities | Evidence only | The policies and procedures that put controls in place. |
| CC6 Logical and physical access | Cloud checks plus evidence | Identity, MFA, keys, encryption and network exposure checked; access reviews and the provider’s own report for premises. |
| CC7 System operations | Cloud checks plus evidence | Logging, threat detection and alarms checked; incident response shown by records. |
| CC8 Change management | Cloud checks plus evidence | Configuration drift and change logging checked; approvals shown by change tickets. |
| CC9 Risk mitigation | Evidence only | Business disruption planning and vendor management. |
| A1 Availability, if in scope | Cloud checks plus evidence | Backups, restore testing and capacity headroom checked; recovery tests shown by records. |
| C1 Confidentiality, if in scope | Cloud checks plus evidence | Encryption and data classification tags checked; retention and disposal shown by records. |
Security, the common criteria, is in every SOC 2 report. Availability, processing integrity, confidentiality and privacy are added when your commitments to customers call for them.
Four criteria, and what each one takes.
For every requirement NxSCORE says how it can be met, and why checks are not enough where they are not.
| Requirement | Covered by | What it takes |
|---|---|---|
| CC6.1 Logical access to systems and data is restricted | Cloud checks plus evidence | Checks cover IAM, MFA, keys and encryption in the cloud; the access policy and the identity provider need evidence. |
| CC7.2 Systems are monitored for anomalies and attacks | Cloud checks plus evidence | Checks show logging, threat detection and alarms are on; records show alerts were reviewed and acted on. |
| CC8.1 Changes are authorised, tested and approved | Cloud checks plus evidence | Checks see drift and change logging in the cloud; change tickets show each change was approved. |
| CC1.4 Competent people are hired, trained and kept | Evidence only | Hiring, training and performance records. |
Every requirement in one record. Now, proved once.
How NxSCORE keeps SOC 2 current.
The daily assessment settles what checks can settle. Your team and your analyst handle the rest, and the record shows who did what.
- 01
A status for every requirement, with the reason.
Each requirement shows how it is met, the checks behind it and whether each ran, the CNAPP policies that count towards it, and its failing resources, with a resource failing in both tools counted once.
Requirement statusSix states- Met
The checks pass, and any evidence it needs is accepted
- Met by compensating control
Met another way, reviewed by your analyst
- Failing
A check fails on at least one resource
- Evidence needed
No accepted evidence, or it has lapsed
- In review
Evidence waiting for your analyst
- Not assessed
The checks behind it could not run
- 02
Evidence prepared by your team, accepted by someone else.
Your team writes up the evidence and attaches the files. Your NxSCORE analyst accepts it, returns it with a reason, or rejects it, and whoever returned it cannot accept the resubmission. Accepted evidence counts to the end of the quarter, plus 30 days, and the daily assessment says when it falls due.
Evidence, one requirementCounted- PreparedYour team writes it up and attaches the files.
- ReviewedYour analyst accepts it, returns it with a reason, or rejects it.
- CountedTo the end of the quarter, plus 30 days.
- Due againThe daily assessment says when, and asks for it fresh.
- 03
Upload once, counted everywhere it applies.
One artifact often answers several frameworks. An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Before accepting, the analyst sees every requirement the upload will meet.
For a Type 2 report the period matters: NxSCORE keeps every daily result and every accepted item with its date, so the record covers the whole period, not one day.
Information security policy, approvedOne uploadRequirement Status ISO 27001 A.5.1 Met PCI DSS 12.1.1 Met NIST CSF GV.PO-01 Met - 04
The fixes that clear the most, first.
Every failing check behind a requirement is ranked by how many requirements it is the only failure in, and how many more it contributes to. The fix kit is written for your engineers to run; NxSCORE’s access stays read-only.
Fix these first, SOC 2 Type 2ExampleFailing check Alone holds back Contributes to CloudTrail log file validation off in 3 accounts Clears 9 14 Root account used in the last 90 days Clears 6 11 Security groups open to the internet on admin ports Clears 4 17 - 05
An evidence pack your assessor can read.
SOC 2 Type 2 downloads as one Excel workbook, laid out requirement by requirement with the evidence beside it. Its first sheet says plainly that it is not a report on compliance: that comes from your independent assessor or auditor.
Evidence pack, SOC 2 Type 2Excel, three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files
Questions about SOC 2 in the cloud.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report describes your controls and whether they were designed well at one point in time. A Type 2 report also tests whether they operated effectively over a period, often six to twelve months. Most customers ask for Type 2.
Does NxSCORE issue a SOC 2 report?
No. A SOC 2 report is issued by an independent CPA firm. NxSCORE keeps the record your auditor tests: each criterion, how it is met in your cloud, and the evidence with who accepted it and when.
Which Trust Services Criteria can cloud checks help with?
Mostly the common criteria for logical access (CC6), system operations (CC7) and change management (CC8), plus availability and confidentiality where they are in scope. Governance, risk assessment and people controls are met with evidence.
See your cloud before the audit period starts.
Connect one cloud account and choose SOC 2. After the first assessment, your analyst takes you through which criteria your cloud already answers, what needs evidence, and how to keep it current for the whole period.