Framework pack in trustlynce
SOC 2
SOC 2 (AICPA Trust Services Criteria)
SOC 2 is an attestation report issued by an independent CPA firm against the AICPA Trust Services Criteria. A Type I report covers control design at a point in time; a Type II report covers how controls operated over a period, usually 3 to 12 months. Type II is where continuous evidence pays off.
Applies to: Service organizations that store or process customer data, especially B2B SaaS.
What to Know
- Five criteria categories: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy.
- Type II auditors sample evidence across the whole observation period, not just audit week.
- Most findings come from access reviews, change management, and vulnerability management that were not done consistently.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| CC6.1 / CC6.2 / CC6.3 | Logical access: provisioning, reviews, and removal | trustlynce pulls users and roles from Okta, GitHub, and cloud IAM on a schedule and runs access review campaigns. TrustIvan adds the non-human identities (service accounts, tokens, CI credentials) that human-only reviews miss. | trustlynce, TrustIvan |
| CC7.1 | Detecting vulnerabilities and configuration changes | TrustIvan scans container images and SBOMs on every build and records triage decisions, which become dated evidence of vulnerability management. | TrustIvan |
| CC7.2 / CC7.3 | Monitoring system components and evaluating security events | aiAxonIQ retains OpenTelemetry logs and traces with alerting and anomaly forecasting; incident timelines are exported to trustlynce as evidence. | aiAxonIQ, trustlynce |
| CC8.1 | Change management | trustlynce collects branch protection settings, pull request reviews, and deployment records from GitHub or GitLab as continuous evidence. | trustlynce |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.