SOC 2 compliance · GRC software
SOC 2 compliance that gets you audit-ready, and keeps you there.
SOC 2 is the security report most B2B buyers ask for first. AEGIS builds your SOC 2 program from a short interview, collects the evidence from your stack and gives the auditor you choose a clean room to work in.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is SOC 2 compliance?
SOC 2 is an attestation report on how a service company protects customer data. It was created by the AICPA, and an independent, licensed CPA firm issues it after testing your controls against the Trust Services Criteria. It is not a certificate and there is no pass or fail: the auditor gives an opinion, and lists any exceptions they found.
Buyers ask for it because it lets them trust your security without auditing you themselves. For a startup selling to US companies, a SOC 2 report is often what moves a deal out of security review.
Requirements
The five Trust Services Criteria
Security is required in every SOC 2 report. The other four are optional and you add them when your customers need them.
- SecurityRequired. The common criteria: access control, change management, risk assessment, monitoring and incident response.
- AvailabilityThe system is up and usable as promised, with backups, capacity planning and recovery.
- Processing integrityProcessing is complete, valid, accurate and authorised.
- ConfidentialityInformation marked confidential is protected through its life and disposed of properly.
- PrivacyPersonal information is collected, used, kept and disposed of in line with your privacy notice.
Explained
SOC 2 Type 1 vs Type 2: which do you need?
A Type 1 report checks that your controls are designed properly at a single point in time. A Type 2 report checks that they actually operated over a period, usually three to twelve months.
Many startups get a Type 1 first to unblock early deals, then move to Type 2, which is what most enterprise buyers expect. With AEGIS the same program carries straight on: evidence keeps collecting during the observation window, so there is no second project.
Checklist
SOC 2 checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Scope: decide which systems, data and Trust Services Criteria the report covers.
- Policies: an information security policy set that matches how you actually work.
- Access: least-privilege access, MFA and regular access reviews with evidence.
- Change management: code review and approvals before changes reach production.
- Risk and vendors: a risk register and a risk assessment for each key supplier.
- Monitoring and response: logging, alerting and a tested incident response plan.
- People: background checks, security training and signed policies for every hire.
- Testing: most auditors expect a recent penetration test, even though the criteria do not name one.
With AEGIS
Get SOC 2 ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes SOC 2 for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- SOC 2 shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
Only a licensed CPA firm can issue a SOC 2 report, and audit fees vary widely with the firm and your scope. Pick the tier that fits your buyers: a tier 1 name for enterprise deals that ask for it, or a tier 2 or 3 firm for a first report at a lower cost, based in the US or India. We help you choose, and AEGIS gives that firm a read-only room with your evidence.
Works with Nexus Void
Security work that becomes SOC 2 evidence.
VAPT
Penetration testing
A recent pentest is evidence most SOC 2 auditors look for. Our VAPT report files straight into AEGIS as penetration-test evidence.
Explore VAPTARGUS
Code security
Change management and secure development are SOC 2 controls. ARGUS findings become risks and evidence, and a Secure Code check fails while a critical finding is open.
Explore ARGUSOther frameworks
One control set, every framework included.
Questions
SOC 2 questions, answered.
Is SOC 2 a certification?
No. SOC 2 is an attestation report. A licensed CPA firm tests your controls and issues an opinion. People often say SOC 2 certification, but there is no certificate.
How long does SOC 2 take?
AEGIS builds the program in an afternoon. Getting audit-ready depends on how fast your team closes real gaps. A Type 1 audit looks at one date; a Type 2 audit then needs an observation window, usually three to twelve months.
How much does a SOC 2 audit cost?
The audit fee is set by the CPA firm and depends on its tier, your scope and Type 1 or Type 2. That is why auditor choice matters: you pick the firm that fits your buyers and budget. AEGIS itself is priced by team size, not by framework.
Is SOC 2 mandatory?
No law requires it. Customers do: many US and enterprise buyers will not sign without a SOC 2 report or an equivalent such as ISO 27001.
SOC 2 or ISO 27001?
SOC 2 is most common with US buyers; ISO 27001 is the international certificate, common in Europe and India. They overlap heavily, and AEGIS maps both onto one control set, so the second is mostly the difference over the first.
Does SOC 2 require a penetration test?
The criteria do not name one, but most auditors expect a recent penetration test as evidence for monitoring and risk controls.
Can we use our own auditor?
Yes. You choose the CPA firm, tier 1, 2 or 3, US-based or India-based, and AEGIS gives them read-only access.
Updated 22 October 2026 by the Nexus Void team.
SOC 2 with AEGIS
Get SOC 2 ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.