US
SOC 2
The AICPA attestation over security, availability, confidentiality, processing integrity and privacy.
Who it applies to
Service providers, especially B2B SaaS, whose customers ask for an independent report.
What it can cost
Lost deals, failed audits and penalties set by your regulator or contract.
- Issued by
- An independent CPA firm
- Report types
- Type 1 at a point in time, Type 2 over a period
- Criteria
- Security, availability, processing integrity, confidentiality, privacy
What SOC 2 asks of you
- 01Control environment and risk assessment
- 02Logical and physical access
- 03System operations and monitoring
- 04Change management
- 05Risk mitigation and vendors
- 06Availability and confidentiality
How orta covers SOC 2
51 SOC 2 requirements, mapped
Each requirement is linked to orta's common controls, so evidence you already have counts here too.
Checked from your own systems
Host, Kubernetes and AWS checks run on a schedule and mark controls passing or failing, every day.
Policies drafted from a conversation
orta interviews your team by voice or text, asks only what SOC 2 needs, and drafts the policy set from the answers.
Ready for your auditor
Give them a read-only login to see controls, evidence and documents in one place.
What feeds it
- Continuous complianceA passing check counts in every framework that needs it.
- Cloud postureYour cloud accounts, checked. Your data, left where it is.
- Runtime detectionCatch the attack while it is happening.
- Kubernetes securityEvery cluster, explained.
- Risk managementRisk that moves with reality.
