EN
Book an expert call

AnnexOps Compliance

SOC 2 Compliance Automation: Evidence Your CPA Can Verify

AnnexOps tracks all 61 Trust Services Criteria: Security (CC1 to CC9) as the required base, with Availability, Confidentiality, Processing Integrity and Privacy added as separate categories when you need them. Criteria map to the shared control library that already carries your ISO/IEC 27001 evidence, so coverage rolls up from controls you already run. Read-only evidence. Hash-chained records.

Book a SOC 2 expert call

All 61 TSC criteria · 154 shared controls linked · Read-only CPA Audit Room

How SOC 2 automation works

Deterministic, versioned, verifiable by your CPA

Rules as data

Every check runs on versioned rules that cite the Trust Services Criterion it evidences. A second auditor re-running the check gets the same verdict for a traceable reason. No LLM decides a classification or a check verdict.

Derivation, not judgment

The platform derives what each criterion requires from facts you record: users, vendors, incidents, changes. Your team makes the judgment calls, such as whether an event becomes a CC7.3 incident or a control exception is accepted and why.

Agents draft, you sign

Agents draft and suggest; they do not decide. Each suggestion lands in Approvals. Nothing changes a record until a named person approves it, and every decision becomes an audit event in the chain.

Evidence you can verify

Connectors read configuration metadata only. Each artefact is hashed and appended to a hash-chained log. Tampering is detectable across the whole Type 2 window, not just on the day a screenshot was taken.

Core capabilities

Six things your CPA will ask to see

Read-only evidence collection

Read-only connectors for GitHub, Amazon Web Services and Microsoft Entra ID collect configuration metadata only, never content. Each artefact is timestamped, hashed and appended to a per-connection chain, then filed against the controls that evidence criteria such as CC6.1 logical access and CC8.1 change management.

743 automated control checks

Continuum runs 743 automated checks against your connected systems and grades each result against the SOC 2 criteria you hold. Failing checks surface as gaps on the hub, with the mapped criterion named; the check-to-criterion mappings for SOC 2 are draft (see FAQ). Automated checks mostly support the Security criteria CC1 to CC9; the add-on categories rely mostly on recorded evidence today.

All 61 criteria, pre-mapped

The hub tracks all 61 criteria: 33 Security common criteria across CC1 to CC9, plus A1 Availability, C1 Confidentiality, PI1 Processing Integrity and P1 to P8 Privacy as add-on categories. Each category shows its assessed requirement coverage, indicative, with the gaps listed.

One control library, many frameworks

SOC 2 criteria link to 154 of the 211 shared controls, the same controls that carry ISO/IEC 27001, NIS2 and DORA references. Evidence attaches to the control, not the framework; the locked SOC 2 card shows how much your existing evidence already covers.

CC6, CC7 and CC9 registers

Quarterly access reviews for CC6.2 and CC6.3, incidents for CC7.3 to CC7.5 and vendor risk for CC9.2 run from the people, incident and supplier registers you already keep. One review or one incident is recorded once and counts for every framework that asks.

Type 2 window, CPA Audit Room

Set the Type 2 observation period and the hub tracks evidence against that window. Invite your CPA to the Audit Room: read-only, scoped to SOC 2 alone, ending on the date you set. Point-in-time evidence packages and compliance reports replace screenshots.

Integrations

Works With Your Existing Stack

  • GitHub
  • Amazon Web Services
  • Microsoft Entra ID
  • Jira (ticketing)
  • SharePoint (document links)
  • GitLab (coming soon)
  • Microsoft Azure (coming soon)
  • Google Cloud (coming soon)
  • Okta (coming soon)
  • Google Workspace (coming soon)
  • Microsoft Intune (coming soon)
  • Jamf (coming soon)

FAQs

Some Frequently Asked Questions and Their Answers

Does AnnexOps issue the SOC 2 report?

No. SOC 2 is an attestation engagement under the AICPA attestation standards (AT-C 105 and AT-C 205), and only a licensed CPA firm issues the report and its opinion. There is no certificate and no certification body. AnnexOps organises your evidence against the 61 Trust Services Criteria, tracks the Type 2 window and gives your CPA a read-only Audit Room. You bring your own auditor; there is no auditor marketplace.

Type 1 or Type 2 first, and how long does the observation window have to be?

A Type 1 report covers the design and implementation of controls as of a date; a Type 2 report adds operating effectiveness over a period. The AICPA mandates no minimum period, but its guidance points to at least six months, and many CPA firms accept three months for a first report. Twelve months is the norm once you report annually. The period covered is stated in every report. AnnexOps records the window you and your CPA agree and tracks evidence against it; your CPA decides what counts toward the period.

We already run ISO/IEC 27001. How much of SOC 2 does that evidence cover?

The product shows you; it does not estimate. SOC 2 criteria link to 154 controls in the same shared library that carries your ISO/IEC 27001 Annex A references. An access review recorded under A.5.18 also evidences CC6.2 and CC6.3. When you add SOC 2, the locked framework card shows the share of criteria your existing evidence already covers, computed for your organisation. It can be low; it is never guessed.

Has the SOC 2 requirement content been reviewed by a specialist?

The SOC 2 requirement content in AnnexOps is AnnexOps-authored and labelled as such in the product; specialist review is in progress. The criteria themselves are the AICPA’s TSP section 100, the 2017 Trust Services Criteria with the 2022 revised points of focus, referenced by identifier. EU AI Act and GDPR content has been reviewed by counsel. Our mappings from automated checks to SOC 2 criteria are likewise draft.

News & Articles

Your ISO work already counts. Bring your own CPA.

Book an expert call: we scope Security plus the categories you need and start with one read-only connection.

Book a SOC 2 expert callStart with one framework
AI Analyzer