← All infographics
SOC 2 · Assessment

SOC 2 Type 2 Assessment

The four phases, the observation-period timeline, and the five Trust Service Criteria.

Four assessment phases
1.Readiness
  • Scoping & definition
  • Gap assessment
  • Control mapping
2.Remediation
  • Fix identified gaps
  • Implement controls
  • Policy development
3.Observation Period
  • Continuous evidence collection
  • Ongoing monitoring
  • Incident-response tracking
4.Final Audit
  • Control testing & validation
  • Reporting & opinion
  • Report issuance
Timeline
OBSERVATION PERIOD · 6–12 MONTHS
StartObservation beginsObservation endsAudit report
Five Trust Service Criteria
SecurityProtection against unauthorised access, use or disclosure.Required
AvailabilitySystems are available for operation and use as committed.
Processing IntegrityProcessing is complete, valid, accurate, timely and authorised.
ConfidentialityInformation designated confidential is protected.
PrivacyPersonal information is collected, used and retained appropriately.
Cianaa Technologies — independent PCI, ISO & SOC assessments across NZ & AU.Book a scoping call →