Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →What SOC 2 actually asks of you, in plain language: the five criteria, the controls, and the evidence auditors want.
SOC 2 is built on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Only Security (the "common criteria") is mandatory; you add the others based on what you promise customers. Meeting the requirements means having documented policies, technical controls (access control, encryption, logging, change management), and evidence that they operated over time, not just on paper.
The numbers
The figures that shape the short answer above. Where they come from is cited in the sections that follow.
SOC 2 does not hand you a fixed checklist of controls. Instead it organizes everything around five categories, and you choose which apply based on the promises you make to customers.
Start with Security, because it is mandatory. Add the others only when you actually commit to them. If you offer an uptime SLA, include Availability. If you handle sensitive personal data, Privacy and Confidentiality may matter. Adding criteria you do not need just adds cost and evidence burden, so scope deliberately.
Underneath the criteria, the work is concrete. Most startups end up with somewhere between 60 and 100-plus controls across a familiar set of categories.
The single biggest reason audits slip is evidence. It is not enough for a control to exist; for a Type II report you must show it operated consistently over the observation window. That means collecting tickets, logs, review records, and approvals over months. Start evidence collection on day one, not the week before the auditor arrives.
| Criterion | Required? | Include when |
|---|---|---|
| Security | Yes (always) | Every SOC 2. The common criteria baseline. |
| Availability | Optional | You commit to uptime or an SLA. |
| Processing Integrity | Optional | Your system transacts or processes customer data. |
| Confidentiality | Optional | You handle data customers designate confidential. |
| Privacy | Optional | You collect and process personal information. |
Only one. Security, also called the common criteria, is mandatory in every SOC 2 report. The other four (Availability, Processing Integrity, Confidentiality, and Privacy) are optional and added only when they reflect commitments you make to customers.
There is no fixed number. SOC 2 defines criteria, not a rigid control list, so the count depends on your scope and systems. Most startups end up with roughly 60 to 100-plus controls once you account for policies, access management, encryption, logging, and change management.
For a Type II report, the auditor wants proof that controls operated over the whole observation window: access review records, change approvals, logs, ticket histories, and policy acknowledgements. Designing a control is not enough; you have to show it ran consistently.
No, and you usually should not. Adding criteria you do not actually commit to just increases cost and evidence work. Include Security plus only the additional criteria that match what you promise customers.
Criteria are the high-level objectives (for example, "logical access is restricted"). Controls are the specific things you do to meet them (MFA, quarterly access reviews, offboarding within 24 hours). You map your controls to the criteria and then prove they work.
traztech Workspace has all 61 criteria of SOC 2 written in plain English, with what the standard asks for, what to do about it, and somewhere to attach the proof. You answer them, it scores you, and nothing is locked behind an upgrade.
No credit card, no trial clock, no locked features. We make money when someone wants help closing the gaps, not from the Workspace.
| traztech Workspace | Other GRC platforms | |
|---|---|---|
| Licence cost | $0. Free forever, no card, no paid tier | $7,500 to $50,000 a year, on an annual contract |
| Control library, evidence register, policy templates, risk register, vendor questionnaires, readiness scoring | Included | Included |
| What it costs inside an engagement with us | $0. You need a workspace either way | Unchanged. The subscription sits on top of the fee |
| What it does to your audit quote | $11,000 off a five-figure quote on one engagement, for a documented readiness position | Nothing. The audit firm prices your readiness, not your tooling |
Pricing in the right column is what compliance automation platforms are publicly reported to charge; none of them publish a number, so treat it as a range rather than a quote. The $11,000 came off the audit firm's own number once the readiness position was documented (the engagement). Where a paid platform is the better buy, and the fuller comparison, is on the Workspace page.
Run the free SOC 2 readiness tool, or have us scope your criteria and run the program end to end.
Book a strategy callWant the human version?
Jacob sends a few short, practical notes on getting security and compliance right without the months of pain. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, principal of traztech. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.