SOC 2 Type II
SOC 2 Type II, for European companies selling to the US.
Continuous evidence across your whole observation period, mapped to the Trust Services Criteria.
What we do for you
- Trust Services Criteria controls
- Continuous monitoring over the observation period
- Evidence reused from ISO 27001
- Auditor-ready export
- Security questionnaire answers
Why AnnexOps
Already working on ISO 27001? Most of the controls and evidence carry over, so SOC 2 builds on work you have already done.
Frequently asked questions
Type I vs Type II?
A Type I report checks that your controls are designed properly at a single point in time. A Type II report checks that they actually worked over an observation period. US enterprise customers usually ask for Type II.
How long is the observation period?
Typically 3 to 12 months.
Do I need SOC 2 if I have ISO 27001?
Often yes, for US customers, who tend to ask for a SOC 2 report specifically. The two overlap heavily, so we reuse most of your ISO 27001 controls and evidence.
