SOC 2
An independent CPA examination evaluates controls against relevant AICPA Trust Services Criteria. Security is the common starting category; applicability and scope depend on the system and commitments.
Framework guide
Choose the framework
that fits the promise.
Frameworks answer different questions. Start with customer commitments, the data you handle, the services you provide and the assurance your buyers ask for.
AuditsteadSample workspaceA starting point for scope conversations
Framework decision notes
Customer requirementWhat was requested?
Clarify
Information involvedWhat do you handle?
Map
Assurance routeWho evaluates it?
Plan
Common frameworks
Similar language can describe different obligations.
Use these descriptions as an orientation, then confirm the actual requirement with your customers, qualified assessors and counsel. Auditstead currently focuses on organizing SOC 2 readiness work; it does not automate or certify the other frameworks listed here.
ISO/IEC 27001
An international standard for information security management systems. Organizations define a system and manage information security risks within that scope.
HIPAA Security Rule
U.S. requirements for safeguarding electronic protected health information apply to covered entities and business associates as defined by HIPAA.
GDPR
An EU regulation concerning protection of natural persons with regard to personal data processing and movement of personal data. Applicability depends on the processing and organization.
PCI DSS
A payment account data security standard for entities that store, process, transmit or can affect the security of payment account data.
Choose with context
Ask these questions before you commit to a program.
The right path is the one that answers a real business or legal requirement and can be operated over time.
What triggered the request?
A customer questionnaire, contract, regulator, insurer or internal risk decision may call for different evidence.
What is in scope?
List services, systems, locations, people, data flows and third parties that support the promise.
Who will assess it?
Clarify whether the path uses an independent CPA examination, accredited certification body, regulator or another assessor.
Auditstead scope
A focused workspace for SOC 2 readiness coordination.
Use Auditstead to organize SOC 2 control records, policies, vendor details, access reviews and activity history. It is not a cross-framework control mapper, a legal interpretation service or an auditor.
Start with your system
Define what you provide and which commitments your customers rely on.
Validate with specialists
Confirm requirements with your assessor and qualified legal or privacy advisers.
Further reading
Start with the source.
These links lead to the organizations responsible for the standards and guidance. Confirm the requirements that apply to your organization with qualified advisers.
Good questions
A few things to know.
Clear answers make it easier to decide what belongs in your process.
Does SOC 2 certify a company?
A SOC 2 report is an independent CPA examination report, not a software certification. The auditor determines and reports on the examination within the agreed scope.
Should we pursue every framework our customers mention?
Not automatically. Clarify the customer's actual requirement, the system and data in scope, and the form of assurance they will accept.
Does Auditstead support ISO 27001, HIPAA or PCI DSS workflows?
The current product is designed around SOC 2 readiness coordination. It does not provide complete automation, control mapping or certification for those other frameworks.
A clearer next step
Bring your questions.
Let’s talk it through.
Discuss your readiness goals, current product scope and pricing with the Auditstead team.
