A curated list of resources, tools, frameworks, and guides for achieving and maintaining SOC 2 compliance.
SOC 2 (System and Organization Controls 2) is a framework developed by the AICPA for managing customer data based on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Whether you are a startup preparing for your first audit or an enterprise maintaining continuous compliance, this list has something for you.
- Official Resources
- Frameworks & Standards
- Readiness Guides & Checklists
- Policy Templates
- Automation Platforms
- Open-Source Tools
- Evidence Collection
- Cloud Security
- Monitoring & Logging
- Access Control & Identity
- Vendor Risk Management
- Penetration Testing
- Incident Response
- Training & Awareness
- Books & Courses
- Podcasts & Newsletters
- Community & Forums
- Endpoint Security & MDM
- Business Continuity & Disaster Recovery
- Consultants & Service Providers
- Contributing
- AICPA SOC 2 Overview - The official AICPA page covering SOC 2 reporting and its purpose.
- AICPA Trust Services Criteria (TSC) - The canonical criteria definitions for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
- AICPA SOC Suite of Services - Full overview of SOC 1, SOC 2, and SOC 3 reports and when each applies.
- SSAE 18 (AT-C 205) - The attestation standard under which SOC 2 examinations are performed.
- SOC 2 Type I vs. Type II Explained - Understanding the difference between point-in-time (Type I) and observation-window (Type II) reports.
- AICPA SOC 2 Reporting FAQs - Frequently asked questions directly from the AICPA.
- NIST Cybersecurity Framework (CSF) 2.0 - Widely adopted risk management framework that maps well to SOC 2 criteria.
- NIST SP 800-53 Rev. 5 - Comprehensive catalog of security and privacy controls used by federal agencies, useful for mapping SOC 2 controls.
- ISO/IEC 27001:2022 - International standard for information security management systems (ISMS). Many controls overlap with SOC 2.
- ISO/IEC 27002:2022 - Supplementary guidance for implementing ISO 27001 controls, useful as a SOC 2 control reference.
- CIS Controls v8 - Prioritized set of 18 cybersecurity actions that map to multiple SOC 2 criteria.
- COSO Internal Control Framework - The foundational internal control model referenced by SOC 2's Common Criteria.
- CSA Cloud Controls Matrix (CCM) v4 - Cloud-specific security controls framework that complements SOC 2 for SaaS providers.
- COBIT 2019 - IT governance and management framework from ISACA with strong SOC 2 alignment.
- HITRUST CSF - Risk-based framework that integrates SOC 2, HIPAA, ISO 27001, and other standards into a single certifiable program.
- SOC 2 to ISO 27001 Control Mapping - Understanding how SOC 2 Trust Services Criteria map to ISO 27001 Annex A controls.
- AICPA SOC 2 Readiness Assessment Guide - Official guidance on scoping and preparing for a SOC 2 engagement.
- TrazTech SOC 2 Readiness Checklist - Free, comprehensive checklist covering all five Trust Services Criteria with actionable steps. Built from real audit experience including a case study that achieved zero exceptions across 76 controls in 75 days.
- TrazTech Cloud Security Posture Check - Free tool to evaluate your cloud environment's security posture against SOC 2-relevant benchmarks for AWS, GCP, and Azure.
- Operating a SOC 2 Type II Observation Window - Practical guide to managing the 3-12 month observation period required for a Type II report, including common pitfalls and evidence collection cadences.
- Vanta SOC 2 Compliance Checklist - Step-by-step compliance checklist with automation context.
- Drata SOC 2 Readiness Guide - Guide covering gap analysis, remediation, and audit preparation.
- StrongDM SOC 2 Compliance Checklist - Checklist focused on access management requirements.
- A-LIGN SOC 2 Readiness Guide - From one of the largest specialized SOC 2 audit firms in the US, covering readiness assessment methodology.
- Tugboat Logic SOC 2 Guide - Practical readiness walkthrough with a focus on evidence mapping (acquired by OneTrust, may redirect).
- Laika SOC 2 Readiness Checklist - Actionable checklist organized by Trust Services Criteria (rebranded as Thoropass).
- Secureframe SOC 2 Timeline Guide - Realistic timelines for SOC 2 readiness based on company size and complexity.
- JupiterOne/security-policy-templates - Open-source security policies and procedures covering SOC 2-relevant domains like access control, incident response, and change management.
- Vanta Policy Templates - Pre-built policy templates aligned to SOC 2, ISO 27001, and HIPAA.
- Blissfully SaaS Management Policies - Policies focused on SaaS governance relevant to SOC 2 vendor management criteria (acquired by Vendr, may redirect).
- Aptible Comply Policy Library - Comprehensive policy library designed for SOC 2, HIPAA, and ISO 27001.
- TemplateLab Security Policy Templates - Free downloadable information security policy templates.
- SANS Policy Templates - Well-regarded security policy templates from SANS Institute covering areas like acceptable use, data classification, and incident response.
- Osano Privacy Policy Templates - Privacy-focused templates relevant to the Privacy Trust Services Criteria.
- Run Comply Policy Templates - GRC platform with policy templates mapped to SOC 2 criteria.
Compliance automation platforms streamline evidence collection, control monitoring, and audit management. Here is a comparison of the major options:
- Vanta - Market leader with the broadest integration ecosystem (375+ integrations). Excellent for companies already using popular SaaS tools. Strong automated evidence collection and continuous monitoring. Can be expensive for smaller teams; pricing scales with employee count.
- Drata - Strong automation with a clean UI and good customer support. Offers 150+ integrations and custom control mapping. Competitive pricing. Particularly strong for companies pursuing multiple frameworks simultaneously (SOC 2 + ISO 27001 + HIPAA).
- Secureframe - Developer-friendly with strong API access and infrastructure-as-code integrations. Good for engineering-led compliance programs. Solid AWS, GCP, and Azure integrations. Offers AI-assisted remediation guidance.
- Sprinto - Cost-effective option popular with startups and mid-market companies, especially outside the US. Offers risk-first approach with continuous control monitoring and built-in training modules.
- Thoropass (formerly Laika) - Combines software platform with in-house audit services for a streamlined end-to-end experience. Good for companies wanting a single vendor for both automation and audit. Can reduce coordination overhead.
- Scytale - Focuses on fast time-to-compliance with a streamlined workflow. Good for companies wanting a simpler, more guided experience. Strong SOC 2 focus with expanding framework support.
- Lacework - Cloud-native security platform with compliance modules (acquired by Fortinet, rebranded as FortiCNAPP). Best for organizations wanting combined CSPM and compliance monitoring from a single tool. Deep AWS, GCP, and Azure integration.
- Tugboat Logic (now OneTrust) - Acquired by OneTrust. Good for enterprises already in the OneTrust ecosystem wanting unified GRC and privacy compliance.
- AuditBoard - Enterprise-grade GRC platform for internal audit, risk, and compliance teams. Suited for large organizations with mature compliance programs. Offers SOC 2 and SOX compliance modules.
- Anecdotes - AI-driven compliance platform that automates evidence collection across business processes. Good for complex enterprises with multiple compliance requirements.
- Hyperproof - Operations-focused compliance platform with strong workflow automation, task management, and audit trail capabilities. Good for compliance teams managing multiple frameworks.
- Strike Graph - Flexible and cost-effective compliance platform with a risk-based approach. Supports SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR.
- prowler-cloud/prowler - AWS/Azure/GCP security assessment tool that maps findings to SOC 2, CIS, PCI DSS, HIPAA, and more. Generates audit-ready reports.
- aquasecurity/trivy - Comprehensive vulnerability scanner for containers, filesystems, IaC, and Git repositories. Essential for SOC 2 vulnerability management evidence.
- bridgecrewio/checkov - Static analysis for infrastructure-as-code (Terraform, CloudFormation, Kubernetes). Prevents misconfigurations before deployment.
- aquasecurity/tfsec - Terraform-specific static analysis focused on security misconfigurations (deprecated - use Trivy). Integrates into CI/CD pipelines.
- open-policy-agent/opa - General-purpose policy engine for enforcing compliance policies as code across your stack.
- ossf/scorecard - Automated security health checks for open-source dependencies, supporting SOC 2 supply chain security requirements.
- cloud-custodian/cloud-custodian - Rules engine for cloud resource management, policy enforcement, and compliance monitoring across AWS, Azure, and GCP.
- mondoohq/cnspec - Cloud-native security and policy tool that scans infrastructure, SaaS, and workloads against SOC 2-relevant benchmarks.
- tenable/terrascan - Static code analysis for IaC with 500+ policies for security best practices and compliance.
- opencontrol/compliance-masonry - Tool for building compliance-as-code documentation. Maps controls to implementations and generates System Security Plans.
- Netflix/security_monkey - Monitors AWS and GCP accounts for security policy changes and alerts on insecure configurations (archived but still referenced).
- ComplianceAsCode/content - ComplianceAsCode content for automated compliance checking against NIST, CIS, and related benchmarks.
- lyft/cartography - Infrastructure asset and relationship mapping for security analysis.
- Elasticsearch + Kibana - Log aggregation and visualization for building SOC 2 audit evidence dashboards.
- osquery - Endpoint visibility using SQL queries. Excellent for collecting evidence about endpoint configurations, installed software, and system hardening.
- FleetDM/fleet - Open-source device management and osquery fleet manager. Provides continuous endpoint compliance visibility across your organization.
- Chef InSpec - Compliance-as-code framework for writing human-readable tests that verify infrastructure compliance. Supports CIS, SOC 2, and custom profiles.
- Kolide - Device trust platform that ensures endpoints meet compliance requirements before accessing resources (acquired by 1Password).
- Orca Security - Agentless cloud security platform that provides deep visibility for evidence collection across cloud workloads.
- Wiz - Cloud security platform with compliance dashboards that map findings to SOC 2, ISO 27001, and PCI DSS.
- Datadog Compliance Monitoring - Continuous compliance posture tracking with out-of-box rules for SOC 2 and CIS benchmarks.
- JupiterOne - Cyber asset management and governance platform that maps relationships between assets, identities, and compliance controls.
- Devo - Cloud-native logging and security analytics platform for centralized evidence collection and retention.
- AWS Audit Manager - Automated evidence collection mapped to SOC 2, PCI DSS, HIPAA, and other frameworks. Pre-built assessment templates.
- AWS Security Hub - Centralized security findings dashboard that aggregates results from GuardDuty, Inspector, Macie, and third-party tools.
- AWS Config - Continuous recording and evaluation of AWS resource configurations against compliance rules.
- AWS CloudTrail - API activity logging across your AWS infrastructure. Essential for SOC 2 audit trails.
- AWS Well-Architected Tool - Self-assessment against AWS best practices including the Security Pillar.
- AWS GuardDuty - Intelligent threat detection for monitoring malicious activity and unauthorized behavior.
- AWS IAM Access Analyzer - Identifies resources shared with external entities, supporting least-privilege access reviews.
- AWS Control Tower - Multi-account governance with guardrails that enforce SOC 2-relevant security policies.
- Google Cloud Security Command Center - Centralized security and risk management platform for GCP.
- Google Cloud Assured Workloads - Compliance controls for regulated workloads on GCP.
- Google Cloud Asset Inventory - Full inventory of GCP resources with historical change tracking for audit evidence.
- Google Cloud Audit Logs - Admin activity, data access, and system event audit logs.
- Google Cloud Organization Policy Service - Centralized constraint enforcement across your GCP organization.
- Forseti Security - Open-source GCP security tooling for inventory, scanning, and enforcement (archived, no longer maintained).
- Microsoft Defender for Cloud - Unified security management with compliance dashboards for SOC 2, CIS, ISO 27001, and more.
- Azure Policy - Policy-as-code for enforcing organizational standards and compliance at scale.
- Azure Compliance Manager - Risk-based compliance assessment tool with pre-built templates for SOC 2 and other frameworks.
- Azure Monitor - Full-stack monitoring, logging, and alerting for Azure resources.
- Azure Activity Log - Subscription-level audit trail of control-plane operations.
- Microsoft Sentinel - Cloud-native SIEM with built-in SOC 2 workbooks and detection rules.
- Prisma Cloud (Palo Alto) - Comprehensive cloud-native application protection platform (CNAPP) with compliance dashboards for SOC 2 across AWS, Azure, and GCP.
- Fugue (now Snyk Cloud) - Cloud security posture management that continuously evaluates infrastructure against SOC 2 and CIS benchmarks.
- Ermetic (now Tenable Cloud Security) - Cloud infrastructure entitlement management (CIEM) and CSPM for multi-cloud environments.
- CloudQuery - Open-source cloud asset inventory powered by SQL. Query your cloud infrastructure for compliance evidence across providers.
- Datadog - Infrastructure monitoring, APM, and log management with SOC 2 compliance monitoring dashboards.
- Splunk - Enterprise SIEM and log analytics platform widely used for SOC 2 evidence retention and security monitoring.
- Grafana + Loki - Open-source log aggregation and visualization stack. Cost-effective alternative for SOC 2 log retention requirements.
- Sumo Logic - Cloud-native log analytics and SIEM with compliance dashboards and pre-built SOC 2 queries.
- New Relic - Full-stack observability platform with compliance-relevant monitoring capabilities.
- PagerDuty - Incident management and on-call scheduling. Provides evidence for SOC 2 incident response and availability criteria.
- Opsgenie (Atlassian) - Alerting and on-call management for demonstrating incident response capabilities.
- Graylog - Open-source log management with compliance reporting features.
- CrowdStrike Falcon LogScale - High-performance log management with security analytics capabilities.
- Wazuh - Open-source security monitoring and compliance platform with SOC 2, PCI DSS, and HIPAA rule sets.
- Okta - Leading identity provider with SSO, MFA, and lifecycle management. Widely used for SOC 2 access control evidence.
- Auth0 - Developer-friendly identity platform for implementing authentication and authorization controls.
- OneLogin - Cloud IAM with SSO, MFA, and directory integration for SOC 2 access management.
- JumpCloud - Directory-as-a-Service combining IAM, device management, and SSO in a single platform.
- ConductorOne - Identity security platform focused on access reviews and least-privilege enforcement for SOC 2 compliance.
- Opal - Automated access management with just-in-time provisioning and access request workflows.
- StrongDM - Infrastructure access management that provides audit trails for database, server, and Kubernetes access.
- Teleport - Open-source identity-aware access proxy for SSH, Kubernetes, databases, and web apps with session recording.
- HashiCorp Vault - Secrets management and encryption-as-a-service. Critical for SOC 2 credential management and encryption requirements.
- CyberArk - Privileged access management (PAM) platform for securing, managing, and auditing privileged credentials.
- BeyondTrust - Privileged access management with session monitoring and least-privilege enforcement.
- SailPoint - Enterprise identity governance for access certification, lifecycle management, and compliance reporting.
- Whistic - Security profile sharing and vendor assessment platform for streamlining SOC 2 vendor risk management.
- OneTrust Vendorpedia - Third-party risk management with automated vendor assessments and risk scoring.
- SecurityScorecard - External security ratings platform that continuously monitors vendor security posture.
- BitSight - Security performance management with vendor risk ratings and benchmarking.
- Prevalent - Unified third-party risk management platform covering security, privacy, and compliance assessments (acquired by Mitratech).
- Venminder - Vendor risk management platform with pre-built assessment questionnaires and ongoing monitoring.
- Risk Recon (Mastercard) - Continuous vendor security monitoring with risk-prioritized assessments.
- HECVAT (Higher Ed) - Open vendor assessment questionnaire useful as a template for SOC 2 vendor evaluations.
- SIG Questionnaire (Shared Assessments) - Standardized Information Gathering questionnaire widely used for third-party risk assessment.
- OWASP Testing Guide v4.2 - Comprehensive methodology for web application security testing relevant to SOC 2 vulnerability management.
- OWASP Top 10 (2025) - The most critical web application security risks. A baseline for SOC 2 application security testing.
- PTES (Penetration Testing Execution Standard) - Methodology standard for consistent and thorough penetration testing engagements.
- Burp Suite - Industry-standard web application security testing toolkit.
- Nmap - Network discovery and security auditing tool for infrastructure penetration testing.
- Metasploit Framework - Open-source penetration testing framework for validating infrastructure security controls.
- Nuclei - Fast and customizable vulnerability scanner with community-maintained templates.
- OWASP ZAP - Open-source web application security scanner, now maintained by Checkmarx under the Linux Foundation.
- Snyk - Developer-first security platform for finding and fixing vulnerabilities in code, dependencies, containers, and IaC.
- Qualys - Cloud-based vulnerability management, detection, and compliance platform.
- Tenable Nessus - Widely used vulnerability scanner for infrastructure and web application assessments.
- PagerDuty Incident Response Guide - Open-source incident response documentation covering processes, roles, and communication templates.
- Atlassian Incident Management Handbook - Practical guide to building incident management processes with runbook templates.
- NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management from NIST, updated in 2025 to align with CSF 2.0. The gold standard for incident response planning.
- TheHive Project - Open-source security incident response platform for SOC teams.
- DFIR Report - Real-world intrusion analysis reports useful for building detection capabilities and incident response playbooks.
- Incident Response Consortium - Free incident response playbook templates for common attack scenarios.
- FireHydrant - Incident management platform with automated runbooks and SOC 2-ready reporting.
- Rootly - Incident management automation integrated with Slack and Jira for streamlined response and retrospectives.
- Blameless - SRE and incident management platform with postmortem automation and compliance reporting.
- KnowBe4 - Security awareness training and simulated phishing platform. Widely used for SOC 2 training evidence.
- SANS Security Awareness - Role-based security awareness training from SANS Institute.
- Curricula - Engaging, story-driven security awareness training platform (acquired by Huntress).
- Hoxhunt - AI-based phishing simulation and security awareness training with gamification.
- Ninjio - Micro-learning security awareness training using Hollywood-style animated episodes.
- Proofpoint Security Awareness - Threat intelligence-driven training from a leading email security vendor.
- Elevation of Privilege (EoP) Card Game - Adam Shostack's threat modeling card game for developer security training.
- OWASP Security Knowledge Framework - Open-source training platform for developers covering secure coding and OWASP guidelines (archived).
- The Phoenix Project by Gene Kim, Kevin Behr, George Spafford - A novel about IT, DevOps, and organizational change that illustrates why compliance culture matters.
- Practical Cloud Security by Chris Dotson (O'Reilly) - Cloud security fundamentals with direct applicability to SOC 2 cloud controls.
- Information Security Policies, Procedures, and Standards by Douglas J. Landoll - Comprehensive guide to building the policy framework SOC 2 requires.
- Designing Data-Intensive Applications by Martin Kleppmann (O'Reilly) - Essential reading for understanding data processing integrity and availability architecture relevant to SOC 2.
- The Compliance Handbook by David Sutton - Practical guide to implementing and managing compliance programs.
- Security Engineering by Ross Anderson - Comprehensive reference covering the technical foundations of trust and security relevant to SOC 2 criteria.
- LinkedIn Learning - SOC 2 Compliance - Introductory course on SOC 2 compliance fundamentals.
- Udemy - SOC 2 Compliance Bootcamp - Practical SOC 2 preparation course covering all Trust Services Criteria.
- ISACA CISA Certification - Certified Information Systems Auditor (CISA) - IT audit certification relevant to SOC 2 auditing, though not SOC 2-specific.
- AICPA SOC for Service Organizations Certificate - Official AICPA certificate program for understanding SOC reporting.
- ISC2 CCSP - Certified Cloud Security Professional - Cloud security certification covering compliance, governance, and architecture.
- CompTIA Security+ - Foundational cybersecurity certification covering many SOC 2-relevant domains.
- Compliance Unfiltered - Podcast covering real-world compliance challenges and practical advice for SOC 2, ISO 27001, and more.
- The Virtual CISO Podcast - Discussions on compliance, security strategy, and practical CISO advice.
- Risky Business - Weekly information security podcast covering news, research, and industry trends.
- CISO Series Podcast - Panel discussions on security leadership, compliance strategy, and risk management.
- Darknet Diaries - True stories from the dark side of the internet, useful for understanding real-world threats that SOC 2 controls protect against.
- Security Now - Long-running security podcast covering vulnerabilities, best practices, and emerging threats.
- Cloud Security Podcast by Google - Google's podcast covering cloud security topics relevant to SOC 2 cloud environments.
- tl;dr sec - Weekly newsletter curating the best security content including compliance, AppSec, and cloud security.
- CloudSecList - Curated newsletter on cloud security news, tools, and best practices.
- Compliance Weekly by A-LIGN - Regular updates on compliance trends, audit insights, and regulatory changes.
- The Hacker News - Daily cybersecurity news covering vulnerabilities, breaches, and compliance-relevant developments.
- Krebs on Security - In-depth investigative security reporting by Brian Krebs.
- r/compliance (Reddit) - Reddit community discussing compliance topics including SOC 2 preparation and audit experiences.
- r/cybersecurity (Reddit) - Broad cybersecurity community with frequent SOC 2 and compliance discussions.
- SOC 2 Questions (AICPA Community) - Official AICPA community forum for SOC reporting questions.
- Cloud Security Alliance Community - CSA community for cloud security and compliance discussions.
- ISACA Community - Professional community for IT governance, risk, and compliance practitioners.
- InfoSec Community on Slack - Active Slack workspace for security and compliance professionals.
- Hacker News (YC) - Frequent discussions on SOC 2 compliance for startups, searchable with "SOC 2" queries.
- ComplianceForge Community - Community focused on cybersecurity and compliance documentation.
- CrowdStrike Falcon - Cloud-native endpoint protection platform with real-time threat detection, EDR, and managed threat hunting.
- SentinelOne - AI-powered endpoint security with autonomous detection, response, and remediation.
- Microsoft Defender for Endpoint - Enterprise endpoint security integrated with Microsoft 365.
- Jamf - Apple device management and security for macOS, iOS, and iPadOS fleets.
- Kandji - Apple MDM with pre-built compliance templates for SOC 2 and CIS benchmarks.
- Mosyle - Apple device management with integrated security for business and education.
- Fleet - Open-source device management and osquery fleet manager for cross-platform endpoint visibility. (GitHub)
- Hexnode - Unified endpoint management across Windows, macOS, iOS, Android, and tvOS.
- Microsoft Intune - Cloud-based endpoint management for Windows, macOS, iOS, and Android.
- AWS Backup - Centralized backup service for AWS resources with cross-region and cross-account capabilities.
- Azure Backup - Cloud-native backup for Azure VMs, SQL databases, and file shares.
- Google Cloud Backup and DR - Managed backup and DR service for Google Cloud workloads.
- Veeam - Enterprise backup and recovery for cloud, virtual, and physical workloads.
- Druva - SaaS-based data protection and backup across endpoints, cloud, and SaaS applications.
- Zerto - Continuous data protection and disaster recovery for hybrid and multi-cloud environments.
- PagerDuty - Incident management and on-call scheduling for maintaining availability SLAs.
- Rootly - Incident management automation with Slack-native workflows and post-incident learning.
- A-LIGN - One of the largest SOC 2 audit firms in the US with broad industry experience.
- Schellman - Top-tier attestation and compliance firm specializing in SOC, ISO 27001, and PCI assessments.
- Coalfire - Cybersecurity advisory firm providing SOC 2 audits, FedRAMP, and PCI assessments.
- KPMG - Big Four firm offering SOC 2 attestation services for large enterprises.
- Deloitte - Big Four firm with global SOC 2 audit capabilities.
- EY (Ernst & Young) - Big Four firm providing SOC 2 assurance services.
- PwC (PricewaterhouseCoopers) - Big Four firm with global SOC 2 attestation and advisory capabilities.
- Moss Adams - Regional audit firm with strong SOC 2 and technology industry expertise.
- BDO - International audit firm offering SOC 2 attestation and advisory services.
- Prescient Assurance - Boutique firm specializing in SOC 2 audits for startups and growth-stage companies.
- Johanson Group - Audit firm focused on SOC 2 and SOC 1 engagements for technology companies.
- CBIZ CPAs (formerly MHM) - National CPA firm with 70+ years of experience offering SOC reporting services, financial audits, and SEC/PCAOB audits across multiple industries.
- Grant Thornton - Major mid-tier firm with a growing SOC 2 attestation practice.
- RSM US - Fifth-largest US audit firm with SOC reporting services across industries.
- Crowe LLP - Top-10 US accounting firm with extensive SOC 2 and SOC 1 experience.
- TrazTech - Toronto-based security and compliance consultancy led by Jacob Masse, a published security researcher with 5 CVEs including CVE-2024-45163 (CVSS 9.1). Specializes in SOC 2 readiness, ISO 27001, HIPAA, PCI DSS, penetration testing, cloud security, and AI/LLM security. Notable engagement: zero exceptions on SOC 2 Type II with 76 controls implemented in 75 days and an $11K audit quote reduction. Offers a free SOC 2 Readiness Checklist, Cloud Security Posture Check, and the TrazTech Workspace - a free compliance tracking portal that replaces $7,500-$50,000/yr GRC platforms. 260+ articles on SOC 2, cloud security, vendor risk, and more at traztech.ca/blog.
- Insight Assurance - Compliance and cybersecurity firm offering SOC 2 readiness assessments and virtual CISO services.
- Pivot Point Security - Information security consulting firm specializing in SOC 2 readiness and ISO 27001 implementation.
- Linford & Company - CPA firm offering SOC 2 audits and readiness assessments with a focus on technology companies.
- Aprio - Advisory firm with SOC 2 readiness, audit, and remediation services.
- KirkpatrickPrice - Information security audit firm providing SOC 2, PCI, and HIPAA compliance services.
Other open-source compliance resources from TrazTech:
- startup-security-policies - 15 security policy templates mapped to SOC 2 and ISO 27001 controls.
- cloud-security-audit-scripts - Pre-audit cloud security scripts for AWS, GCP, and Azure.
- awesome-compliance-automation - 270+ compliance automation tools across all major frameworks.
- vendor-risk-assessment-toolkit - Vendor risk assessment templates, scoring, and automation.
Contributions are welcome! Please read the contribution guidelines first.
This list is maintained by the community. If you know of a resource that should be included, please open a pull request.
To the extent possible under law, the contributors have waived all copyright and related or neighboring rights to this work. See LICENSE for details.