https://irmcon.com/component---src-pages-products-soc-2-js-5f518c007c68b8ea79c1.js

1"use strict";(self.webpackChunkgatsby_starter_hello_world=self.webpackChunkgatsby_starter_hello_world||[]).push([[4910],{1682:function(e){e.exports=JSON.parse('{"layout":"constrained","images":{"fallback":{"src":"/static/a3324e603e559adfb920cda87a8d3de8/c53c2/soc2-gap-assessment.webp","srcSet":"/static/a3324e603e559adfb920cda87a8d3de8/8af21/soc2-gap-assessment.webp 400w,\\n/static/a3324e603e559adfb920cda87a8d3de8/55c7e/soc2-gap-assessment.webp 800w,\\n/static/a3324e603e559adfb920cda87a8d3de8/c53c2/soc2-gap-assessment.webp 1600w","sizes":"(min-width: 1600px) 1600px, 100vw"},"sources":[]},"width":1600,"height":840}')},2822:function(e,t,a){a.r(t),a.d(t,{Head:function(){return W},default:function(){return z}});var i=a(6540),n=a(4194),r=a(5792),s=a(986),o=a(3124),c=a(3048),l=a(4479),d=a(8894),m=a(2532),p=a(3915),u=a(7786);const h=["A Gap Assessment against the AICPA 2017 Trust Services Criteria (with Revised Points of Focus, 2022), the control criteria used in SOC2 examinations","Two assessment levels: SOC2 Type I and SOC2 Type II both cover all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy; Type II adds an Evidence (12 Months) field to every criterion for links to evidence artifacts covering the last 12 months","Likelihood and impact scoring for every gap on a 5x5 risk matrix","Gaps ranked Low, Medium, High, or Critical","An Executive Summary with your compliance score and top risks","A phased remediation roadmap across 30, 90, 180, and 365 day horizons, downloadable in PDF or Word format with your company logo"],y=[{title:"Capture your Company Profile",text:"Enter your company name, website, and a description of what the company does, choose the SOC2 Type I or SOC2 Type II assessment level, and add your logo for the report."},{title:"Assess each Trust Services Criterion",text:"Work through all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy, mark each one compliant, partially compliant, non-compliant, or not applicable, rate the likelihood and impact of each gap, and at the Type II level insert links to evidence artifacts covering the last 12 months."},{title:"Download your Report and Remediation Roadmap",text:"Review your compliance score and risk-ranked gaps, then download a PDF or Word report with an executive summary, detailed findings, and a phased remediation roadmap."}],g=[{label:"What the auditor opines on",t1:"The design and implementation of your controls at a single point in time.",t2:"The design, implementation, and operating effectiveness of your controls over a review period, commonly 3 to 12 months."},{label:"Evidence required",t1:"Evidence that each control exists and is suitably designed as of the review date, such as policies, configurations, and walkthroughs.",t2:"Evidence that each control operated throughout the period: access review records, change tickets, incident records, monitoring reports, and training logs sampled across the full window."},{label:"How this tool maps to it",t1:"The SOC2 Type I level assesses all 61 Trust Services Criteria as a point-in-time readiness review.",t2:"The SOC2 Type II level assesses the same 61 criteria and adds an Evidence (12 Months) field to every criterion, so you can capture links to the artifacts that prove each control operated over the last 12 months."},{label:"Typical timeline",t1:"Faster: readiness, remediation, then a point-in-time examination.",t2:"Longer: an observation period must elapse before the examination, so evidence collection discipline matters from day one."},{label:"Who usually asks for it",t1:"Early-stage customers and partners who need initial assurance quickly.",t2:"Enterprise customers and procurement teams, who usually expect a Type II report renewed annually."}],v=[{id:"Security",series:"CC1 to CC9",count:33,covers:"The Common Criteria, mandatory in every SOC2 examination: control environment, communication and information, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, and risk mitigation."},{id:"Availability",series:"A1",count:3,covers:"Capacity management, environmental protections, data backup and recovery infrastru

1cture, and recovery plan testing that keep the system available per your commitments and SLAs."},{id:"Processing Integrity",series:"PI1",count:5,covers:"Processing specifications plus controls over system inputs, processing, outputs, and stored items so processing is complete, valid, accurate, timely, and authorized."},{id:"Confidentiality",series:"C1",count:2,covers:"Identifying, protecting, retaining, and verifiably disposing of confidential information in line with your confidentiality commitments."},{id:"Privacy",series:"P1 to P8",count:18,covers:"Notice, choice and consent, collection, use, retention and disposal, data subject access, disclosure and breach notification, data quality, and privacy dispute handling and compliance monitoring for personal information."}],f=[{c:"CC1",name:"Control Environment",req:"Demonstrate integrity and ethical values, board oversight, defined structures and reporting lines, commitment to competence, and individual accountability for internal control.",ev:"Code of conduct, org chart, board minutes, job descriptions, training and performance records."},{c:"CC2",name:"Communication and Information",req:"Generate and use quality information for internal control, communicate objectives and responsibilities internally, and communicate commitments and incidents to external parties.",ev:"System description, policy portal, security awareness communications, customer notifications, whistleblower channel."},{c:"CC3",name:"Risk Assessment",req:"Specify clear objectives, identify and analyse risks including fraud risk, and assess changes that could significantly impact internal control.",ev:"Risk assessment procedure, risk register, fraud risk analysis, change impact assessments."},{c:"CC4",name:"Monitoring Activities",req:"Perform ongoing and separate evaluations of internal control and communicate deficiencies to those responsible for corrective action.",ev:"Vulnerability scans, penetration test reports, internal audit reports, deficiency tracking."},{c:"CC5",name:"Control Activities",req:"Select and develop control activities including general controls over technology, and deploy them through policies and procedures.",ev:"Control matrix, approved policies and procedures with owners and review dates."},{c:"CC6",name:"Logical and Physical Access Controls",req:"Restrict logical and physical access to protected information assets: identity management, authentication, least privilege, access reviews, physical security, secure disposal, boundary protection, encryption, and anti-malware.",ev:"Access control policy, MFA configuration, joiner-mover-leaver tickets, access review records, badge logs, disposal certificates, encryption settings."},{c:"CC7",name:"System Operations",req:"Detect configuration changes and vulnerabilities, monitor for anomalies and security events, evaluate and respond to incidents, and recover from them.",ev:"Monitoring and alerting configuration, SIEM reports, incident response plan, incident records and post-mortems, response test results."},{c:"CC8",name:"Change Management",req:"Authorize, design, test, approve, and implement changes to infrastructure, data, software, and procedures.",ev:"Change management policy, change tickets with approvals and test evidence, emergency change reviews."},{c:"CC9",name:"Risk Mitigation",req:"Develop risk mitigation activities for business disruptions and manage risks associated with vendors and business partners.",ev:"Business continuity plan, insurance review, vendor inventory, vendor due diligence and periodic review records."},{c:"A1",name:"Availability",req:"Manage processing capacity, implement environmental protections, backups and recovery infrastructure, and test recovery plans.",ev:"Capacity monitoring dashboards, backup configuration and restoration tests, BC/DR test results."},{c:"PI1",name:"Processing Integrity",req:"Define processing specifications and control system inputs, processing, outputs, and stored items for complete, accurate, timely, authorized processing.",ev:"Data definitions, input validation rules, processing error and reconciliation reports, output delivery controls."},{c:"C1",name:"Confidentiality",req:"Identify and maintain confidential information, and dispose of it in a manner that prevents recovery when no longer needed.",ev:"Data classification policy, retention schedule, destruction and erasure records."},{c:"P1 to P8",name:"Privacy",req:"Provide notice, obtain consent, limit collection and use, retain and dispose securely, grant data subject access and correction, control disclosures with breach notification, maintain data quality, and handle privacy inquiries, complaints and disputes.",ev:"Privacy notice, consent records, retention schedule, DSAR process records, disclosure logs, breach notification procedure, complaint register."}],C={overflowX:"auto",marginTop:"18px",marginBottom:"8px"},w={width:"100%",borderCollapse:"collapse",background:"#fff",fontSize:"15px",lineHeight:1.55},A={background:"#0B2540",color:"#fff",textAlign:"left",padding:"10px 14px",fontSize:"14px",border:"1px solid #dbe7f2",verticalAlign:"top"},b={padding:"10px 14px",border:"1px solid #dbe7f2",verticalAlign:"top",color:"#33404f"},E=e=>e%2==1?{background:"#f4fbfe"}:void 0,S={position:"absolute",width:"1px",height:"1px",padding:0,margin:"-1px",overflow:"hidden",clip:"rect(0,0,0,0)",whiteSpace:"nowrap",border:0},I=p.B6.slice(0,4),k=p.B6.slice(4);function T(e){let{section:t}=e;const n=!t||"intro"===t,r=!t||"guide"===t,s=!t||"faqs"===t;return i.createElement(i.Fragment,null,n&&i.createElement(i.Fragment,null,i.createElement("section",{className:"irm__dataSecurityPrivacyIntroSectionsWrap irm__aiGovernanceIntroSectionsWrap"},i.createElement("div",{className:"irm__imgAndDescWrapper background__light"},i.createElement(c.A,null,i.createElement(l.A,null,i.createElement("div",{className:"col-12"},i.createElement("div",{className:"irm__descWrapInner","data-aos":"fade"},i.createElement("h2",{className:"main__title"},"What is the SOC2 Gap Assessment?"),i.createElement("p",null,"The SOC2 Gap Assessment is a free, self-serve tool from ",i.createElement("a",{href:"https://irmcon.com/",target:"_blank"},"IRM Consulting & Advisory")," that measures your organization against the ",i.createElement("a",{href:"https://www.aicpa-cima.com/resources/article/aicpa-system-and-organization-controls-communications-guidelines/",target:"_blank"},"AICPA 2017 Trust Services Criteria")," (with Revised Points of Focus, 2022), the control criteria a licensed CPA firm uses in a SOC2 examination."),i.createElement("p",null,"You choose your level: SOC2 Type I assesses all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy as a point-in-time readiness review, and SOC2 Type II assesses the same criteria and adds an Evidence (12 Months) field to every criterion so you can insert links to evidence artifacts covering the last 12 months. You assess each criterion, score gaps by likelihood and impact, and download a professional report with an executive summary, detailed findings, and a prioritized remediation roadmap.")))),i.createElement(l.A,{className:"mt-4"},i.createElement("div",{className:"col-12"},i.createElement("div",{className:"irm__descWrapInner","data-aos":"fade"},i.createElement("h2",{className:"main__title",id:"what-is-soc2"},"What is SOC2?"),i.createElement("p",null,"SOC2 (System and Organization Controls 2, often written SOC2) is an assurance framework from the American Institute of Certified Public Accountants (AICPA) in which a licensed CPA firm examines a service organization's controls against the ",i.createElement("a",{href:"https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services",target:"_blank",rel:"noopener noreferrer"},"Trust Services Criteria"),": Security, Availability, Processing Integrity, Confidentiality, and Privacy. For ",i.createElement("a",{href:"https://irmcon.com/soc-2-compliance/",target:"_blank",rel:"noopener noreferrer"},"SOC2 Compliance"),", a SOC2 Type I report covers how controls are designed at a point in t

1ime, while a SOC2 Type II report covers how those controls operated over a period, typically 6 to 12 months. SOC2 is an attestation report rather than a certification, and it has become the de facto security credential SaaS companies need to sell to enterprise customers.")))),i.createElement(l.A,{className:"mt-4"},i.createElement("div",{className:"col-md-6 irm__descWrap"},i.createElement("div",{className:"irm__descWrapInner","data-aos":"fade-up"},i.createElement("h2",{className:"main__title"},"What you get"),i.createElement("ul",{className:"bullet__listWrap"},h.map((e,t)=>i.createElement("li",{key:t},e))))),i.createElement("div",{className:"col-md-6 irm__descWrap"},i.createElement("div",{className:"irm__descWrapInner","data-aos":"fade-up"},i.createElement("h2",{className:"main__title"},"Who it is for"),i.createElement("p",null,"The assessment is built for small and medium organizations, startups, and growing SaaS companies that face customer security questionnaires or enterprise procurement requirements and want to understand where they stand against the Trust Services Criteria before engaging a CPA firm."),i.createElement("p",null,"The SOC2 Type I level is the right starting point for teams preparing for their first examination, while the SOC2 Type II level suits teams heading into an operating-effectiveness review period who need to start collecting and organizing 12 months of evidence."))))))),i.createElement("section",{className:"irm__servicesListWrapper","aria-label":"How the SOC2 Gap Assessment works"},i.createElement("div",{className:"home-flagship"},i.createElement("div",{className:"fl-container",style:{paddingTop:"16px",paddingBottom:"16px"}},i.createElement("h2",null,"How it works"),i.createElement("div",{className:"fl-grid fl-g3",style:{marginTop:"24px"}},y.map((e,t)=>i.createElement("div",{className:"fl-card fl-svc","data-aos":"fade-up",key:t},i.createElement("div",{className:"fl-ico","aria-hidden":"true"},t+1),i.createElement("span",{className:"fl-tag"},`Step ${t+1}`),i.createElement("h3",{className:"service__title"},e.title),i.createElement("p",null,e.text)))),i.createElement(u.A,{text:"We never see your assessment data, we do not store it, it stays in your local Browser."}))))),r&&i.createElement("section",{className:"irm__dataSecurityPrivacyIntroSectionsWrap irm__aiGovernanceIntroSectionsWrap","aria-label":"SOC2 gap assessment guide"},i.createElement("div",{className:"irm__imgAndDescWrapper background__light"},i.createElement(c.A,null,i.createElement(l.A,null,i.createElement("div",{className:"col-12"},i.createElement("div",{className:"irm__descWrapInner","data-aos":"fade"},i.createElement("h2",{className:"main__title",id:"what-is-a-soc2-gap-assessment"},"SOC2 Gap Analysis explained"),i.createElement("p",null,"A SOC2 gap analysis, also called a gap assessment, is a structured comparison of your organization's current controls against the AICPA Trust Services Criteria, identifying which criteria you already meet, where you fall short, and what to fix first. It is the standard starting point for any SOC2 readiness project, run before you engage a CPA firm so the formal examination holds no surprises."),i.createElement("p",null,"A good gap assessment, sometimes called a SOC2 readiness assessment or self-assessment, answers three questions. Firstly, Coverage: which Trust Services Categories belong in your report scope, given what you commit to customers about security, availability, processing integrity, confidentiality, and privacy? Secondly, Conformance: for each criterion, do you have the control, the documentation, and the evidence an auditor would sample?"),i.createElement("p",null,"Thirdly, Priority: of the gaps you find, which ones expose real risk to your customers, your data, and your compliance obligations, and in what order should you close them? The ",i.createElement("a",{href:"#assessment-tool"},"free assessment tool above")," works exactly this way: every gap is scored by likelihood and impact on a 5x5 risk matrix, so the output is a prioritized remediation roadmap rather than a flat checklist."),i.createElement("h3",{style:{marginTop:"28px"},id:"type1-vs-type2"},"SOC2 Type I vs SOC2 Type II"),i.createElement("p",null,"A SOC2 Type I report opines on whether your controls are suitably designed and implemented at a single point in t

1ime. A SOC2 Type II report goes further: it opines on whether those controls operated effectively over a review period, commonly 3 to 12 months, which is why Type II is what enterprise customers usually require. Both report types are examinations of the same Trust Services Criteria; the difference is the evidence. That is exactly how the tool on this page treats them: both levels assess all 61 criteria, and the Type II level adds an Evidence (12 Months) field to every criterion so you can capture links to the artifacts that prove each control operated over the last 12 months."),i.createElement("div",{style:C},i.createElement("table",{style:w},i.createElement("caption",{style:S},"Comparison of SOC2 Type I and SOC2 Type II"),i.createElement("thead",null,i.createElement("tr",null,i.createElement("th",{scope:"col",style:A}),i.createElement("th",{scope:"col",style:A},"SOC2 Type I"),i.createElement("th",{scope:"col",style:A},"SOC2 Type II"))),i.createElement("tbody",null,g.map((e,t)=>i.createElement("tr",{key:e.label,style:E(t)},i.createElement("th",{scope:"row",style:{...b,fontWeight:600,whiteSpace:"nowrap"}},e.label),i.createElement("td",{style:b},e.t1),i.createElement("td",{style:b},e.t2)))))),i.createElement("h3",{style:{marginTop:"28px"},id:"trust-services-categories"},"What the five Trust Services Categories cover"),i.createElement("p",null,"The 2017 Trust Services Criteria (with Revised Points of Focus, 2022) contain 61 criteria organized into five categories. Security, expressed as the 33 Common Criteria CC1 to CC9, is mandatory in every SOC2 examination; the other four categories are added to the report scope based on the commitments you make to customers. This assessment covers all five categories so nothing is missed when you decide your report scope."),i.createElement("div",{style:C},i.createElement("table",{style:w},i.createElement("caption",{style:S},"The five Trust Services Categories and what they cover"),i.createElement("thead",null,i.createElement("tr",null,i.createElement("th",{scope:"col",style:A},"Category"),i.createElement("th",{scope:"col",style:A},"Criteria series"),i.createElement("th",{scope:"col",style:A},"Criteria"),i.createElement("th",{scope:"col",style:A},"What it covers"))),i.createElement("tbody",null,v.map((e,t)=>i.createElement("tr",{key:e.id,style:E(t)},i.createElement("td",{style:{...b,fontWeight:600,whiteSpace:"nowrap"}},e.id),i.createElement("td",{style:b},e.series),i.createElement("td",{style:b},e.count),i.createElement("td",{style:b},e.covers)))))),i.createElement("h3",{style:{marginTop:"28px"},id:"evidence-12-months"},"How the Evidence (12 Months) field prepares you for Type II"),i.createElement("p",null,"The single biggest cause of SOC2 Type II findings is not missing controls, it is missing evidence: the control operated, but nobody can produce the access review, the change ticket, or the test result from eight months ago. At the Type II level, this tool adds an Evidence (12 Months) field to every criterion where you type or insert links to the artifacts that demonstrate operation over the last 12 months, for example policy documents, ticketing queries, monitoring reports, or folders in SharePoint, Google Drive, or your GRC platform."),i.createElement("p",null,"Your evidence links are included against each criterion in the Detailed Findings section of the downloadable report, giving you a working evidence index you can hand to your auditor at the start of fieldwork, and an immediate view of which controls are operating without a paper trail. Criteria with no evidence link are your earliest warning of a Type II exception."),i.createElement("h3",{style:{marginTop:"28px"},id:"criteria-reference"},"Trust Services Criteria Series Reference"),i.createElement("p",null,"The table below summarizes each criteria series in the 2017 Trust Services Criteria and the evidence auditors typically expect to see. The summaries are condensed guidance prepared by IRM Consulting & Advisory, not verbatim AICPA criteria text; the assessment tool above walks you through all 61 criteria at either level."),i.createElement("div",{style:C},i.createElement("table",{style:w},i.createElement("caption",{style:S},"Trust Services Criteria series summaries and typical audit evidence"),i.createElement("thead",null,i.createElement("tr",null,i.createElement("th",{scope:"col",style:A},"Series"),i.createElement("th",{scope:"col",style:A},"Area"),i.createElement("th",{scope:"col",style:A},"Summary"),i.createElement("th",{scope:"col",style:A},"Evidence auditors expect"))),i.createElement("tbody",null,f.map((e,t)=>i.createElement("tr",{key:e.c,style:E(t)},i.createElement("td",{style:{...b,whiteSpace:"nowrap"}},i.createElement("b",null,e.c)),i.createElement("td",{style:b},e.name),i.createElement("td",{style:b},e.req),i.createElement("td",{style:b},e.ev)))))),i.createElement("p",{style:{marginTop:"20px"}},"Closing the gaps is where most organizations want help. IRM's ",i.createElement("a",{href:"https://irmcon.com/virtual-ciso-services-vciso/"},"Virtual CISO services")," take teams from gap assessment through certification readiness for SOC2, ISO27001, ISO 42001 and CMMC, and our ",i.createElement("a",{href:"/governance-risk-compliance-grc/"}

1,"Governance, Risk & Compliance services")," build the policies, evidence habits and vendor management programs a clean Type II report depends on."))))))),s&&i.createElement("section",{className:"irm__vcisoFaqsWrapper"},i.createElement("div",{className:"floating__circleWrap"},i.createElement(m.S,{src:"../../assets/images/floating-circle.png",alt:"floating circle",placeholder:"blurred",loading:"lazy",quality:75,width:160,height:160,__imageData:a(9354)})),i.createElement(l.A,null,i.createElement(c.A,null,i.createElement("div",{className:"image__titleSecWrapper"},i.createElement("div",{className:"section__thumbWrap","data-aos":"fade"},i.createElement(m.S,{src:"../../assets/images/faq-page-thumbnail.webp",alt:"Frequently Asked Questions",placeholder:"blurred",loading:"lazy",quality:75,width:500,height:500,__imageData:a(9089)}))),i.createElement("div",{className:"image__titleSecWrapper"},i.createElement("div",{className:"section__header","data-aos":"fade"},i.createElement("h2",null,"SOC2 Gap Assessment FAQs"))),i.createElement(l.A,null,i.createElement("div",{className:"col-md-6"},i.createElement("div",{className:"faq__listWrapper"},i.createElement(d.A,{defaultActiveKey:"0"},I.map((e,t)=>i.createElement(d.A.Item,{eventKey:String(t),key:t},i.createElement(d.A.Header,null,e.q),i.createElement(d.A.Body,null,i.createElement("p",null,e.a))))))),i.createElement("div",{className:"col-md-6"},i.createElement("div",{className:"faq__listWrapper"},i.createElement(d.A,{defaultActiveKey:"0"},k.map((e,t)=>i.createElement(d.A.Item,{eventKey:String(t),key:t},i.createElement(d.A.Header,null,e.q),i.createElement(d.A.Body,null,i.createElement("p",null,e.a))))))))))))}var x=a(4417),O=a(6309);function _(){return i.createElement(O.A,{eyebrow:"IRM Product",title:"SOC2 Gap Assessment",subtitle:"The SOC2 Gap Assessment is a free tool that measures your organization against the AICPA 2017 Trust Services Criteria (with Revised Points of Focus, 2022) used in SOC2 examinations. Assess all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy at the SOC2 Type I or SOC2 Type II level; generate a downloadable report that includes a remediation roadmap.",ctaPrimary:{label:"Book a Free Consultation",to:"/cybersecurity-consulting-appointments/"},ctaSecondary:{label:"Talk to an Expert",to:"/cybersecurity-consulting-contact-us/"},trustFacts:["All 61 AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy)","Risk-ranked gaps & remediation roadmap","FREE, built by an AI-Native vCISO for SMBs"],backgroundImage:i.createElement(m.S,{src:"../../assets/images/soc2-gap-assessment.webp",alt:"SOC2 Gap Assessment - IRM Consulting & Advisory",placeholder:"none",quality:75,loading:"eager",__imageData:a(1682)})})}var P=a(3883),N=a(9465);const R="/products/soc2-app/",q=[{name:"Home",url:"/"},{name:"Products",url:"/products/"},{name:"SOC2 Gap Assessment",url:"/products/soc2/"}],W=()=>{const e=(0,n.useStaticQuery)("1271460761").site.siteMetadata.siteUrl,t={"@context":"https://schema.org","@type":["SoftwareApplication","WebApplication"],"@id":`${e}/products/soc2/#app`,name:"SOC2 Gap Assessment",url:`${e}/products/soc2/`,applicationCategory:"BusinessApplication",operatingSystem:"Web browser",isAccessibleForFree:!0,offers:{"@type":"Offer",price:"0",priceCurrency:"USD"},description:"A free gap assessment tool that measures organizations against the AICPA 2017 Trust Services Criteria (with Revised Points of Focus, 2022) used in SOC2 examinations. Assess all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy at the SOC2 Type I level, or add an Evidence (12 Months) field to every criterion at the SOC2 Type II level. Score gaps by likelihood and impact on a 5x5 risk matrix and download a professional report with an executive summary, detailed findings, and a prioritized remediation roadmap in PDF or Word format.",datePublished:"2026-07-31",dateModified:s.O,publisher:{"@id":"https://irmcon.com/#org"},provider:{"@id":"https://irmcon.com/#org"},isPartOf:{"@id":"https://irmcon.com/#website"},inLanguage:["en-CA","en-US"],browserRequirements:"Requires JavaScript. Runs in any modern web browser.",audience:{"@type":"Bu

1sinessAudience",audienceType:"Small businesses, SMBs, startups, and SaaS companies preparing for a SOC2 Type I or SOC2 Type II examination"},keywords:"free SOC2 gap assessment, free cybersecurity tools for small businesses, SOC2 readiness, AICPA Trust Services Criteria, SOC2 Type I, SOC2 Type II, risk-ranked gaps, remediation roadmap",about:[{"@type":"Thing",name:"SOC2 (System and Organization Controls 2)",sameAs:["https://en.wikipedia.org/wiki/System_and_Organization_Controls","https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services"]},{"@type":"Thing",name:"AICPA Trust Services Criteria (2017, with Revised Points of Focus 2022)",sameAs:["https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services"]}],mentions:[{"@type":"Organization",name:"American Institute of Certified Public Accountants (AICPA)",sameAs:["https://en.wikipedia.org/wiki/American_Institute_of_Certified_Public_Accountants","https://www.aicpa-cima.com/"]}],subjectOf:{"@type":"CreativeWork",name:"SOC2 Gap Assessment structured data for AI assistants",url:"https://irmcon.com/ai/products/soc2.json",encodingFormat:"application/json"},featureList:["Assesses all 61 criteria of the AICPA 2017 Trust Services Criteria (with Revised Points of Focus, 2022)","Covers Security (Common Criteria CC1 to CC9), Availability, Processing Integrity, Confidentiality and Privacy","SOC2 Type I level for point-in-time readiness","SOC2 Type II level adds an Evidence (12 Months) field per criterion for links to evidence artifacts","Scores each gap by likelihood and impact on a 5x5 risk matrix","Ranks gaps as Low, Medium, High, or Critical","Generates a report with an executive summary and detailed findings","Builds a phased remediation roadmap (30, 90, 180, 365 days)","Downloads as PDF or Word with your company logo"]};return i.createElement(i.Fragment,null,i.createElement("title",null,"Free SOC2 Gap Assessment | IRM Consulting & Advisory"),i.createElement("meta",{charSet:"UTF-8"}),i.createElement("meta",{httpEquiv:"X-UA-Compatible",content:"ie=edge"}),i.createElement("meta",{name:"robots",content:"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}),i.createElement("meta",{property:"og:locale",content:"en_US"}),i.createElement("meta",{property:"og:site_name",content:"IRM Consulting & Advisory"}),i.createElement("meta",{property:"og:type",content:"website"}),i.createElement("meta",{property:"og:title",content:"Free SOC2 Gap Assessment | IRM Consulting & Advisory"}),i.createElement("meta",{property:"og:image",content:`${e}/og/soc2-og.png`}),i.createElement("meta",{property:"og:image:width",content:"1200"}),i.createElement("meta",{property:"og:image:height",content:"630"}),i.createElement("meta",{property:"og:image:alt",content:"Free SOC2 Gap Assessment tool by IRM Consulting & Advisory, covering all 61 AICPA Trust Services Criteria at Type I and Type II"}),i.createElement("meta",{name:"twitter:card",content:"summary_large_image"}),i.createElement("meta",{name:"twitter:title",content:"Free SOC2 Gap Assessment | IRM Consulting & Advisory"}),i.createElement("meta",{name:"twitter:image",content:`${e}/og/soc2-og.png`}),i.createElement("meta",{name:"twitter:site",content:"IRM Consulting & Advisory"}),i.createElement("meta",{name:"description",content:"Get Free SOC2 Gap Assessment against all 61 AICPA Trust Services Criteria with a risk-ranked remediation roadmap."}),i.createElement("meta",{name:"keywords",content:"SOC2 Gap Assessment, SOC2 Compliance, SOC2 readiness assessment, AICPA Trust Services Criteria, SOC2 Type I, SOC2 Type II, Common Criteria, security availability processing integrity confidentiality privacy, SOC2 evidence collection, gap assessment, remediation roadmap"}),i.createElement("meta",{property:"og:url",content:`${e}/products/soc2/`}),i.createElement("meta",{property:"og:description",content:"Get Free SOC2 Gap Assessment against all 61 AICPA Trust Services Criteria with a risk-ranked remediation roadmap."}),i.createElement("meta",{property:"twitter:description",content:"Get Free SOC2 Gap Assessment against all 61 AICPA Trust Services Criteria with a risk-ranked remediation roadmap."}),i.createElement("link",{rel:"canonical",href:`${e}/products/soc2/`}),i.createElement("script",{type:"application/ld+json",dangerouslySetInnerHTML:{__html:JSON.stringify(t)}}),i.createElement("script",{type:"application/ld+json",dangerouslySetInnerHTML:{__html:JSON.stringify((0,r.W)(q,e))}}),i.createElement("script",{type:"application/ld+json",dangerouslySetInnerHTML:{__html:JSON.stringify((0,p.Os)(p.B6))}}),i.createElement("script",{type:"application/ld+json",dangerouslySetInnerHTML:{__html:JSON.stringify({"@context":"https://schema.org","@type":"HowTo",name:"How to run your SOC2 Gap Assessment",description:"Use IRM's free SOC2 Gap Assessment tool to measure your organization against all 61 AICPA Trust Services Criteria at the SOC2 Type I or SOC2 Type II level, score gaps by likelihood and impact, link 12 months of evidence artifacts at the Type II level, and download a report with a prioritized remediation roadmap.",step:[{"@type":"HowToStep",position:1,name:"Capture your company profile",text:"Enter your company name, website, and a description of what the company does, and choose the SOC2 Type I or SOC2 Type II assessment level.",url:`${e}/products/soc2/#assessment-tool`},{"@type":"HowToStep",position:2,name:"Assess each Trust Services Criterion",text:"Work through all 61 criteria across Security, Availability, Processing Integrity, Confidentiality and Privacy, mark each one compliant, partially compliant, non-compliant, or not applicable, rate the likelihood and impact of each gap, and at the Type II level insert links to evidence artifacts covering the last 12 months.",url:`${e}/products/soc2/#assessment-tool`},{"@type":"HowToStep",position:3,name:"Download your report and roadmap",text:"Review your compliance score and risk-ranked gaps, then download a PDF or Word report with an executive summary, detailed findings, and a phased remediation roadmap.",url:`${e}/products/soc2/#assessment-tool`}]})}}),i.createElement("script",{type:"application/ld+json",dangerouslySetInnerHTML:{__html:JSON.stringify({"@context":"https://schema.org","@type":"WebPage","@id":`${e}/products/soc2/#speakable`,url:`${e}/products/soc2/`,speakable:{"@type":"SpeakableSpecification",cssSelector:[".main__title",".sub__title",".accordion-button",".accordion-body"]}})}}))};function z(){return(0,i.useEffect)(()=>{function e(e){if(e.origin!==window.location.origin)return;const t=document.getElementById("irm-soc2-frame");

1if(!t||e.source!==t.contentWindow)return;const a=e&&e.data;a&&("irm-analytics"===a.type&&a.event?"function"==typeof window.gtag&&window.gtag("event",a.event,a.params||{}):"irm-soc2-height"===a.type&&a.height&&(t.style.height=a.height+24+"px"))}return window.addEventListener("message",e),()=>{window.removeEventListener("message",e)}},[]),i.createElement(x.A,null,i.createElement(r.A,{items:q,siteUrl:"https://irmcon.com"}),i.createElement(_,null),i.createElement(T,{section:"intro"}),i.createElement("section",{id:"assessment-tool",className:"irm__productToolWrapper",style:{background:"#eef3f7",padding:"32px 0 56px"}},i.createElement("div",{className:"container-fluid",style:{maxWidth:"1340px"}},i.createElement("iframe",{id:"irm-soc2-frame",title:"SOC2 Gap Assessment Tool",src:R,loading:"lazy",style:{width:"100%",minHeight:"640px",border:"none",borderRadius:"14px",boxShadow:"0 6px 24px rgba(6,40,61,.12)",background:"#eef3f7"}}),i.createElement("p",{style:{fontSize:"13px",color:"#5b6b7b",textAlign:"center",marginTop:"16px"}},"Not loading?"," ",i.createElement("a",{href:R,target:"_blank",rel:"noopener noreferrer",style:{color:"#0e7897",fontWeight:600}},"Open the SOC2 Gap Assessment tool in a new tab"),"."),i.createElement("p",{style:{fontSize:"12px",color:"#5b6b7b",textAlign:"center",marginTop:"8px"}},"This assessment is a self-serve working draft to support professional review and decision-making. It is not a SOC2 examination, attestation, certification or legal advice, and it is not affiliated with or endorsed by the AICPA. We recommend you seek advice from a ",i.createElement("a",{href:"https://irmcon.com/virtual-ciso-services-vciso/",style:{color:"#0e7897",fontWeight:600}},"Virtual CISO"),". Learn more about our ",i.createElement("a",{href:"/governance-risk-compliance-grc/",style:{color:"#0e7897",fontWeight:600}},"Governance, Risk & Compliance services"),"."))),i.createElement(T,{section:"guide"}),i.createElement(T,{section:"faqs"}),i.createElement("div",{className:"home-flagship"},i.createElement(o.A,null),i.createElement(P.A,null),i.createElement(N.A,null)))}},9089:function(e){e.exports=JSON.parse('{"layout":"constrained","placeholder":{"fallback":"data:image/webp;base64,UklGRsYBAABXRUJQVlA4WAoAAAAQAAAAEwAAEwAAQUxQSMIAAAABgKJt27Hp+dL/j7kFJ9s2ktXsBSixs9pIRrJtJHum/njvwfN9gxVExATQv1fbOtmoFHkZZy9qAWjmghV0zkJWNEoyu1BawSVB8TnT/MwI7p4ZA4A3IU6YVzO5moWhB/CpcjkY1zK1yGcuwsJawQoswJnZCXS/ZfYB9NL36OTh+OJRaMavUpJf7+Zjv5GVaHNU53oYrqrIaXqdy9Qjm0KC/YtIoWvTu3Zx/exy92Jzcbq90vUbEUlqU0tra0tTtUT/G1ZQOCDeAAAAUAQAnQEqFAAUAD6RQptKJaOiIagIALASCWwAI8A3igiHApfUNcRlMrVuQAD+r5CbA2pq/YQR3F3FUzVdlwZB/sf3tq8/ejds9Jbn3vc2IN1YB0PRYZ+KI13kmjdhqXi3h/yHIiaVRdj9dLfoxLK9erC5V+uQkX2/g/rR2znOVLzvl281SEDu34yzof+uBmaMq9YrBWv3uzR/FxfH/GuC0ZOKAjXJ14z1Drh//+YmSpjw22EXYbh74+H0Ozvpq+//yXB+p1GcMs9qgYmd7m7kM/eyOqGEkn2/8lDslgAA"},"images":{"fallback":{"src":"/static/80792ac27ac896d805e10be9fe6d4036/6426e/faq-page-thumbnail.webp","srcSet":"/static/80792ac27ac896d805e10be9fe6d4036/ca00d/faq-page-thumbnail.webp 125w,\\n/static/80792ac27ac896d805e10be9fe6d4036/818c5/faq-page-thumbnail.webp 250w,\\n/static/80792ac27ac896d805e10be9fe6d4036/6426e/faq-page-thumbnail.webp 500w","sizes":"(min-width: 500px) 500px, 100vw"},"sources":[]},"width":500,"height":500}')},9354:function(e){e.exports=JSON.parse('{"layout":"constrained","placeholder":{"fallback":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAACXBIWXMAAAsTAAALEwEAmpwYAAABdklEQVR42q1VwU6DQBBdYntpObWwS5c2DTTWD/AD/DT/xSMnUcS02KCeOXjosQfRCth+xLqzRAqBhrTwEsIms/N2ZmfmLUIFMEn8fNYhixhjJzTp03ZOvfRT+Jq8xQbYYE/BpwLCoLmRSp+3V5NlSMndRx+xvAOTRg8/veF9SOEA2Jv3LUFzoimxYwPd+h1UB8jC/jS0VTStJuMG3f0el9KvxME24D4lUgid34tRT1RNDL5kscFZ6NTbza8D1kXnIgi6wCEKhe2EjB+/9NOjK0Y54Byi+thJTL7oo4ZQrV8Ze6GJFF7+YmucCYtdqKtwhvTX3SVqCdC/7RJCtoKwlZStNGUoimqt5eZFWcuil/FLQibLPW2tbURjw2U2amx2aOx0dDYYBv3kKNn/6HGReM+UpwVxcDJxkEqkcBryK+WruJnvEZGlSnP8cCGwvJ+GXGBHAevBBOSnAcYUbEpRYGtSyT0BqhvOxDPACwfrVKpifHPkCfgDI0zSbaVcXasAAAAASUVORK5CYII="},"images":{"fallback":{"src":"/static/7db374e877e3fc0b05a97b3f514358cc/7cc55/floating-circle.png","srcSet":"/static/7db374e877e3fc0b05a97b3f514358cc/d156e/floating-circle.png 33w,\\n/static/7db374e877e3fc0b05a97b3f514358cc/7d9d1/floating-circle.png 66w,\\n/static/7db374e877e3fc0b05a97b3f514358cc/7cc55/floating-circle.png 131w","sizes":"(min-width: 131px) 131px, 100vw"},"sources":[{"srcSet":"/static/7db374e877e3fc0b05a97b3f514358cc/3b69a/floating-circle.webp 33w,\\n/static/7db374e877e3fc0b05a97b3f514358cc/336c2/floating-circle.webp 66w,\\n/static/7db374e877e3fc0b05a97b3f514358cc/cb356/floating-circle.webp 131w","type":"image/webp","sizes":"(min-width: 131px) 131px, 100vw"}]},"width":160,"height":160}')}}]);