Run the SOC 2 controls your auditor tests, and keep the proof
A SOC 2 Type 2 report asks whether your controls operated throughout the period, not whether they existed on one day. Ciyora runs the access, monitoring and change controls behind the common criteria and keeps a dated record of every review, decision and incident.
About SOC 2
A SOC 2 report is an attestation by an independent CPA firm on a service organization's controls, measured against the AICPA's Trust Services Criteria. The security category, made up of the common criteria CC1 to CC9, is in every SOC 2 report; availability, processing integrity, confidentiality and privacy are added when they matter to your customers. A Type 1 report looks at the design of controls at a point in time; a Type 2 report also tests whether they operated effectively over an observation period, often six to twelve months.
Much of the testing lands on logical access (CC6), system operations (CC7) and change management (CC8). Those are the criteria where Ciyora runs the control itself, so the evidence is a by-product of daily work rather than a collection exercise before fieldwork.
How Ciyora maps to the requirement areas
Each row names a control area, what Ciyora does for it, and the evidence it can produce. Your own policies, people and processes still matter: the platform helps you operate and evidence the controls.
| Requirement area | How Ciyora helps | Evidence you can produce | Modules |
|---|---|---|---|
| CC6.1 Logical access security over protected information assets | One identity record per person across your identity provider, applications and cloud accounts; deny-by-default network access by identity, group and device posture; credential vault for privileged secrets. | Identity and entitlement inventory, versioned network access policy, vault inventory with rotation state. | Fortress, VPN |
| CC6.2 Registering, authorizing and removing users | Joiner, mover and leaver automation from your HR system; access requests with approval before access is granted; leavers deprovisioned across connected systems. | Joiner-mover-leaver activity reports and request approval history with approver and time. | Fortress |
| CC6.3 Role-based access, least privilege and segregation of duties | Periodic access reviews with reasons required for high-risk decisions; separation-of-duties policies checked before a request is approved and scanned afterwards; unused grants flagged. | Access review evidence packs with every decision, reviewer, time and comment; SoD violation and exception reports. | Fortress, Comply |
| CC6.1 and CC6.3 Privileged access | Just-in-time elevation with approval and MFA; break-glass with multiple approvers; recorded SSH, RDP and VNC sessions; owners and expiry for service accounts and API keys. | Privileged access reports, session recordings, vault check-out logs and non-human identity inventory. | Fortress |
| CC6.6 Protection against threats from outside the system boundary | Zero-trust network access over WireGuard with no inbound ports for remote access; external attack-surface discovery and certificate monitoring. | Access policy history, device posture results and attack-surface findings. | VPN, Discover |
| CC6.7 Restricting the transmission and movement of information | Encrypted transport for remote access; endpoint data-protection policies for file transfers, USB devices, printing and AI tools, with employee notices built in. | Data-protection events and policy violations. | VPN, Monitor |
| CC6.8 Preventing or detecting unauthorized or malicious software | Endpoint detection with signature and indicator matching, memory scanning, file integrity monitoring and response actions. | Endpoint detections and the response taken. | Detect |
| CC7.1 Detecting configuration changes and new vulnerabilities | Cloud posture checks with drift detection; vulnerability scanning ranked by CVSS, EPSS and the CISA Known Exploited Vulnerabilities catalog. | Posture score history, findings workflow and vulnerability status over time. | Armor, Discover |
| CC7.2 Monitoring system components for anomalies | Central log collection and search, Sigma detection rules mapped to MITRE ATT&CK, behaviour baselines and identity threat detection. | Detection coverage, alert history and log search results. | Detect, Fortress |
| CC7.3 to CC7.5 Evaluating, responding to and recovering from incidents | Incident queue with owner and severity, correlation across endpoint, network, email and identity, timelines of signals, notes and response actions, playbooks under your approval. | Incident records with timelines, actions and closure notes. | Detect, Neural Mesh |
| CC8.1 Change management | Versioned access policy with diff, test and roll back; infrastructure-as-code scanning before deployment; every administrative change written to a hash-chained audit log. | Policy version history, IaC findings and audit log exports with chain verification. | VPN, Armor, Comply |
| CC9.2 Vendor and business partner risk | Contractor, vendor and guest identities with sponsors and expiry; a catalogue of SaaS applications with sensitivity, owners and who has access. | Third-party identity reports and SaaS inventory with access lists. | Fortress, Discover |
| CC4.1 Monitoring of controls | Control status rolled up into a posture score for SOC 2, with snapshots across the period; an agent flags controls whose evidence is stale or missing. | Posture snapshots and history for the observation period. | Comply, Neural Mesh |
Evidence for the whole observation period
Auditors sample. They pick a quarter's access review, a handful of leavers, a few changes and a few incidents, and ask to see what happened. Ciyora keeps each of those as a dated record: review campaigns with every decision, leaver deprovisioning by date, policy versions and incident timelines. Reports export as PDF, CSV, XLSX or JSON, and the audit log can be verified end to end so the records can be relied on.
Compliance automation platforms such as Vanta and Drata collect evidence from the systems you already run and track your readiness. Ciyora is a different layer: it is the identity, access, detection and posture system that runs the controls, with Ciyora Comply mapping the results to SOC 2 and other frameworks.
Please note. Ciyora is not a certification and does not make an organization compliant on its own. This page describes how Ciyora capabilities map to requirement areas and help you produce evidence. Always read the current text of the regulation or standard and take advice from your compliance team, auditors or legal counsel.
Walk through your control set with us
Bring your latest audit observations or gap assessment, and we will show where Ciyora fits and where it does not.