ArborGRC
Sign in Book a Demo
Information security

SOC 2 Readiness, Organised by Criterion

SOC 2 is the AICPA attestation framework that service organisations use to show customers their controls meet the Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy.

Book a DemoBrowse the Frameworks
SOC 2 assessment Example data
Implemented68%
Partially implemented21%
Gaps11%
Corrective actions SOC 2
CAPA-21CC1 Control EnvironmentIn progress
CAPA-24CC3 Risk AssessmentOverdue
Structure

How SOC 2 Is Organised in Arbor

SOC 2 loads with its trust services criteria, ready to assign and assess.

  • 01CC1 Control Environment
  • 02CC2 Communication and Information
  • 03CC3 Risk Assessment
  • 04CC4 Monitoring Activities
  • 05CC5 Control Activities
  • 06CC6 Logical and Physical Access
  • 07CC7 System Operations
  • 08CC8 Change Management
  • 09CC9 Risk Mitigation
  • 10Availability
  • 11Processing Integrity
  • 12Confidentiality
  • 13Privacy
In Arbor GRC

What Arbor Does with SOC 2

  • Trust Services Criteria loaded, from CC1 to CC9 and the additional categories
  • Controls mapped to ISO 27001 and NIST 800-53, so one control serves several reports
  • Evidence organised by criterion, ready for your auditor
  • Readiness tracked before the Type 1 or Type 2 audit window
Module

Information Security

SOC 2 lives in the Information Security module.

Arbor AI

No Clause Numbers to Memorise

Arbor AI suggests the SOC 2 requirements that apply as you work.

How it works

SOC 2 in Four Steps

  1. Load

    SOC 2 loads with its full structure, kept up to date by our team.

  2. Set Scope

    Decide what applies and record the reason.

  3. Assess

    Assign owners, score each requirement and link evidence.

  4. Prove

    Close gaps with corrective actions and report with confidence.

Mapping

Do the Work Once for SOC 2

Where controls overlap, shared evidence counts toward related frameworks, so nothing is done twice.

SOC 2Information security
UAE IARelatedISO 27001RelatedISO 27017RelatedNIST 800-53RelatedCIS ControlsRelated
Questions

Frequently Asked Questions

Is SOC 2 Kept Up to Date?

Yes. Our team loads SOC 2 and updates it when the standard changes.

Can We Import Our Existing SOC 2 Assessment?

Yes. Use the Excel template and Arbor checks every row before it loads.

Can SOC 2 Share Evidence with Other Frameworks?

Yes. Evidence is uploaded once and linked to every requirement it supports.

See SOC 2 in Arbor GRC

Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.

Book a Demo