SOC 2 Report Analyzer
Drop in a SOC 2 Type 2 report and get an instant, structured analysis of the exceptions, scope, and risks inside it.
Sample results
This is example output. Upload a report on the left to see your own analysis here.
SOC 2 Type 2
Acme Cloud Services, Inc.
Unqualified opinion2 exceptions
- Auditor
- Sample Assurance LLP
- Audit period
- Jan 1, 2025 to Dec 31, 2025
- Published
- Feb 15, 2026
SecurityAvailabilityConfidentiality
Auditor opinion
In our opinion, the controls were suitably designed and operated effectively throughout the period, with the exceptions noted below.
Products and services in scope
2
Acme PlatformAcme API
Controls
2
Common Criteria · 32 validated
CC1.1The entity demonstrates a commitment to integrity and ethical values.CC1.2The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.CC1.3Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.CC1.4The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.CC1.5The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.CC2.1The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.CC2.2The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.CC2.3The entity communicates with external parties regarding matters affecting the functioning of internal control.CC3.1The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.CC3.2The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.CC3.3The entity considers the potential for fraud in assessing risks to the achievement of objectives.CC3.4The entity identifies and assesses changes that could significantly impact the system of internal control.CC3.5The entity assesses the design and operating effectiveness of controls, and evaluates and communicates deficiencies as a basis for corrective action.CC4.1The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.CC4.2The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.CC5.1The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.CC5.2The entity also selects and develops general control activities over technology to support the achievement of objectives.CC5.3The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.CC6.2Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.CC6.3The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.CC6.4The entity restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives.CC6.5The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's objectives.CC6.6The entity implements logical access security measures to protect against threats from sources outside its system boundaries.CC6.7The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives.CC6.8The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.CC7.1To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.CC7.3The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.CC7.4The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate.CC7.5The entity identifies, develops, and implements activities to recover from identified security incidents.CC8.1The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.CC9.1The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.CC9.2The entity assesses and manages risks associated with vendors and business partners.
Availability · 3 validated
A1.1The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.A1.2The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives.A1.3The entity tests recovery plan procedures supporting system recovery to meet its objectives.
Confidentiality · 2 validated
C1.1The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.C1.2The entity disposes of confidential information to meet the entity's objectives related to confidentiality.
Exceptions
- CC6.1
Test: Inspected the quarterly user access review for a sample of users.
For 1 of 25 sampled terminated users, access was not removed within the required 5 business days.
- CC7.2
Test: Inspected the security monitoring alert configuration.
For 1 of 3 months sampled, the log monitoring alert threshold was not configured in line with policy.
Management responses
1
- CC6.1
Exception: Access not removed within 5 business days of termination.
Management implemented an automated deprovisioning workflow to enforce timely access removal.
Subservice organizations
2
Amazon Web ServicesCloudflare
Fourth parties
1
Amazon Web Services
Infrastructure and hosting subservice organization.
Complementary user entity controls
2
User entities are responsible for provisioning and deprovisioning their own users within the platform.User entities are responsible for enforcing multi-factor authentication for their users.
Complementary subservice organization controls
2
Amazon Web Services is responsible for restricting physical access to its data centers.Cloudflare is responsible for maintaining redundant network infrastructure and DDoS protection.
Untested controls
1
- PI1.2Controls over processing integrity of the reporting module.
Feature was released after the audit period and was not in scope for testing.