- Home
- Frameworks
- SOC 2
SOC 2
Evidence for the whole observation period, not one screenshot.
A SOC 2 Type II report looks at how controls operated over months. ACSE checks the cloud configuration behind the Security, Availability and Confidentiality criteria on every scan, and keeps a signed record of each finding, its fix and who approved it.
Operating evidence, continuously
Scans run on a schedule and every result is recorded, so you can show how a control held over the period.
Change management your auditor can follow
Each fix shows what changed, who approved it and how it was verified, in a record they can check offline.
A scope you can defend
ACSE tracks the criteria cloud configuration supports and says so. The rest stay with your team.
Coverage
Tracked criteria with a check behind them
ACSE tracks 38 points from the Common Criteria (Security) and the Availability and Confidentiality criteria. Many describe processes rather than configuration, which is why fewer are backed by checks. Controls without a check are listed as manual, beside the score, so nothing quietly drops out of view.
- AWS
- 8 of 38 tracked criteria
- Google Cloud
- 7 of 38 tracked criteria
- Azure
- 5 of 38 tracked criteria
A case, start to finish
What your auditor can see
- FindingThe check that failed, the resource and the criteria it affects.
- ProposalThe change as code, validated against a plan, with its blast radius and recovery plan.
- DecisionA security approver who did not author the change decides with MFA, bound to the exact view they saw.
- VerificationAfter the change applies, ACSE re-reads the resource and watches it through an observation window before sealing the case.
Offline verification
Your auditor checks it without an account
Export a case and your auditor verifies its signatures and hash chain on their own machine, with independent command-line verifiers in Python and TypeScript that must agree.
The records live in your own cloud, under retention lock, so the evidence does not depend on ACSE being reachable.
Questions
What people ask us
Does ACSE give us a SOC 2 report?
No. A SOC 2 report comes from an independent CPA firm. ACSE checks the cloud configuration behind the criteria it tracks and keeps evidence your auditor can verify.
Can ACSE help with the observation period?
Yes. Scans run on a schedule, and each result and each fix is recorded with its time, so you can show how a tracked control held across the period, including any time it failed and how quickly it was fixed.
Which criteria does ACSE track?
The Common Criteria for Security, plus the Availability and Confidentiality criteria. Processing Integrity and Privacy are not tracked.
Keep reading
Related
Auditors
Verify ACSE evidence offline with an open verifier and no ACSE account: a signed, hash-chained record of who approved each change and how it was tested.
ReadPlatformEvidence
ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.
ReadFrameworksISO/IEC 27001
ACSE lists every ISO/IEC 27001:2022 Annex A control and shows which ones its cloud checks evaluate, with the rest marked manual for your team to attest.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.