The SOC 2 Security Default Findings Engine is a requirement-aware template layer for AICPA Trust Services Criteria - Security Common Criteria. It helps a team define consistent starting language for recurring findings while the normal project remains the source of truth for scope, evidence, ownership, remediation progress, validation, and reports.
Library and standards scope
The SOC 2 Security Library organizes readiness work against the Common Criteria, including governance, communication, risk assessment, monitoring, control activities, access, operations, change management, and risk mitigation. voiqq supports readiness and evidence coordination; it does not issue a CPA attestation opinion.
Global, local, and project layers
- Global defaults are standards-based templates published by voiqq platform owners for a system Library.
- Local defaults belong to the signed-in workspace administrator and can override editable wording without changing the global source.
- A project finding receives copied template values and then becomes an independent record.
- Later global changes do not silently rewrite a local override or a finding already created in a project.
- Status is Open and validation is Pending when the reusable default is applied, unless an authorized project workflow later changes them.
Fields and canonical mapping
Each template is owned by a canonical control criterion in the SOC 2 Security Library. The reusable record contains a stable identifier, summary, description, remediation guidance, severity key, mapped values, source Library, and display order. The visible wording can be edited locally, while the background requirement identity continues to support filters, reports, imports, and New Finding suggestions.
Create or customize a default
- Confirm the system boundary, report target, and selected Trust Services Categories.
- Open the Security local engine and locate the most precise Common Criterion.
- Name the reusable gap without claiming that every organization has the same control design.
- Describe the evidence or operating condition that would demonstrate the gap.
- Add remediation that identifies the desired control outcome and accountable process.
- Use the template in a project, then add population, sample, evidence, owner, and period details.
Writing rules for reusable findings
Write the summary as a concise statement of the recurring failure. Use the description to explain the expected behavior, likely impact, or control concern in neutral language. Use remediation to describe the desired outcome rather than a patch tied to one framework or customer. Store actual results, reproduction steps, affected assets, evidence, people, dates, measurements, samples, and environment details in the project finding.
Suitable template subjects
- Periodic access reviews are incomplete, late, or unsupported by retained approval evidence.
- MFA coverage excludes an in-scope identity population or privileged access path.
- Change records do not demonstrate approval, testing, segregation, or deployment evidence.
- Security events are not reviewed or escalated according to the documented process.
- Third-party risk assessments are missing, overdue, or disconnected from remediation.
Use a default in a project
Open New Finding inside a project configured with SOC 2 Security. Choose Template mode or select a prepared template after choosing the applicable control criterion. voiqq prefills the reusable values. Review every field, add the real evidence and context, and save the finding. Comments, attachments, assignments, history, validation, sharing, exports, and reports then use the same normal project workflow.
Accuracy and safety checks
- Separate evidence gaps from control design or operating gaps.
- Do not prefill populations, samples, dates, or management responses.
- Keep attestation conclusions out of readiness templates.
- Confirm the criterion mapping and evidence request support the same issue.
- Require validation before closing the finding.