FAQ: What should we check before changing compliance platforms?

Export your evidence, control mapping, review history, issues, and ownership records before ending the old contract. Check whether the export includes attachments and timestamps, not just a summary spreadsheet. Plan how auditors will access records covering the reporting period, and test a few exported files before the migration. Record when collection switches to the new platform and identify any gaps or duplicated records. Review contract terms for retention and deletion with the appropriate owner. Changing tools should improve the workflow without losing the history that explains how controls operated before the switch.

Related: SOC 2 audit and compliance hub.

Further reading: NIST control-assessment guidance.

Additional FAQs

Does a SOC 2 report certify that an AI product is safe or accurate?

No. A SOC 2 report addresses the described system and controls against the applicable criteria within the engagement's scope. It is not a blanket certification of an AI product's safety,

Can our SOC 2 auditor also help us prepare?

Some preparation assistance may be possible, but independence needs to be evaluated for the actual services and relationships. Ask the CPA firm to explain the permitted scope of help and

SOC 1 or HITRUST?

The SOC 1 has a completely different purpose than HITRUST. Typically a company would perform both if they are a TPA processing medical claims and other claims, where, there is

When should AI use be discussed with our SOC 2 auditor?

Bring it up when AI is part of the service being examined, supports an in-scope process, handles relevant information, or affects how a control operates. Explain the use case, provider,

What is a SOC 2?

The System and Organization Controls 2 Report, formally known as a Service Organization Controls Report as of the most recent update to the SSAE 18 audit standard. A SOC 2 report

What if no employee left or no incident occurred during the period?

Do not manufacture an event to fill an evidence request. Confirm that there really were no relevant occurrences and retain the records supporting that conclusion. For departures, that might involve

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide