SOC 2 Technical Readiness Audit

Code-level first pass against the SOC 2 Trust Services Criteria — logical access, change management, monitoring, incident recovery, and data lifecycle controls an auditor will actually test, checked from your repo before you pay for the real audit.

This audit evaluates 31 checks across six sections mapped to the SOC 2 Trust Services Criteria (2017, with 2022 points of focus) — logical access (CC6.1-6.3), system boundaries and supply chain (CC6.6-6.8), change management (CC8.1), vulnerability management and monitoring (CC7.1-7.2), incident readiness and recovery (CC7.3-7.5, A1), and data lifecycle (C1). It is deliberately scoped to the engineering half of SOC 2 readiness, the technical controls that are visible in a repository. Policies, HR processes, vendor management, and access reviews live outside your codebase and still need doing. A high score here means your code and its committed evidence would hold up under the technical portion of an audit. It does not mean you are SOC 2 compliant, and no tool that only reads a repository can honestly tell you that.

Changelog