SOC 2 is an AICPA reporting framework through which an independent CPA evaluates controls at a service organization against relevant Trust Services Criteria. voiqq supports readiness, gap assessment, evidence coordination, remediation, and internal review; it does not issue the independent SOC 2 attestation report.
Standards and scope
A voiqq SOC 2 project uses the Security Common Criteria as its foundation and can add Availability, Confidentiality, Processing Integrity, or Privacy according to the organization's commitments and scope. Project metrics record whether the target is Type I or Type II and identify the system or service being assessed.
- Security Common Criteria address control environment, communication, risk assessment, monitoring, access, operations, change management, and risk mitigation.
- Availability addresses commitments for system availability, capacity, recovery, and related controls.
- Confidentiality addresses protection of information designated as confidential.
- Processing Integrity addresses whether processing is complete, valid, accurate, timely, and authorized.
- Privacy addresses personal-information commitments across notice, choice, collection, use, retention, access, disclosure, quality, and monitoring.
Who this is for
- Students, educators, and early-career GRC professionals learning evidence-based control assessment.
- Security, compliance, risk, privacy, and internal-audit teams preparing for an examination.
- Startups, service organizations, SaaS providers, and agencies coordinating readiness work.
- Advisors, assessors, control owners, and public or regulated organizations reviewing supplier assurance.
What voiqq provides
- Project setup for selected Trust Services Criteria, Type I or Type II target, and system scope.
- Canonical criterion mapping for control gaps, evidence requests, exceptions, and remediation items.
- Fields for population, sample, test procedure, evidence, exception, compensating controls, and management response.
- Assignments, comments, evidence, status, validation, due dates, and change history.
- Readiness-oriented reports and snapshots built from reviewed criteria and project records.
A practical workflow
- Define the system boundary, services, commitments, criteria, period, and responsible owners.
- Map controls and evidence to the most precise canonical criteria in scope.
- Document evidence requests, populations, samples, tests, exceptions, and residual gaps.
- Assign remediation, collect updated evidence, and validate corrective action.
- Review the readiness snapshot with the appropriate compliance and audit stakeholders.
Put the framework into practice
Use the SOC 2 Program to teach structured control testing, coordinate first-time readiness, manage recurring evidence work, or give leadership and advisors a clearer view of unresolved gaps.