SOC 2
Get audit-ready without an evidence scramble
A Type II report is a claim about how your controls operated over a period of months. Gwenda collects that evidence as the period runs, so the audit becomes a review of material you already hold.
Audit-ready without the evidence scramble
Gwenda maps your existing controls to the Trust Services Criteria and collects evidence continuously through the observation window, then shows you which criteria are still short, months before the auditor does.
Discovery
What Gwenda finds, and where it finds it
Every finding names the system it came from. That is what makes it evidence rather than an assertion.
Joiner, mover and leaver events
Access granted on start, changed on role change, and (the criterion most reports fail on) actually revoked on departure, timed against the HR record. Read from HR system, Entra ID, Okta.
Whether change management held for every change
Pull requests merged without review, deployments that bypassed the pipeline, and direct pushes to production branches. Read from GitHub, GitLab, CI/CD.
Access reviews, and whether they were completed
Who was asked to review, what they attested to, and which reviews quietly lapsed. Read from Identity provider, ticketing.
Policy currency and acknowledgement
Which policies are past their review date and which staff have not acknowledged the current version. Read from Confluence, Notion, HR system.
Incident records against the response commitment
Incidents raised, time to triage and time to close, measured against the process you told the auditor you follow. Read from Jira, ServiceNow, PagerDuty.
Your vendor inventory as it really is
SaaS applications with production or customer data access, including the ones procured on a card without a review. Read from OAuth grants, SSO application list, finance system.
The benchmark
The Gwenda gold standard for SOC 2
Every Security criterion operating and evidenced across the full observation window, with the additional categories you have committed to in customer contracts. The measure is not whether a control exists, but whether it can be shown to have operated continuously.
- Control environment and governance
- Defined roles, board or leadership oversight, and policies that are approved and current, with evidence they have been read by the people they apply to.
- Logical access
- Provisioning, review and prompt revocation of access, with each joiner-mover-leaver event evidenced against the HR record.
- Change management
- Code review, testing and approval before production, evidenced straight from the repository and pipeline.
- Risk assessment
- A risk register that is reviewed as often as it says it will be, with treatment owners and dates that are actually met.
- Monitoring and incident response
- Logging and alerting feeding a tested incident process, with incidents recorded, triaged and closed out with evidence.
- Vendor management
- A current vendor inventory with risk ratings and evidence that critical vendors were reviewed inside the period.
Illustrative figures. Yours are measured from your own systems.
How it works
The same four moves, applied to your obligations.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Outcomes
What changes for you
Know your readiness months out
A criterion-by-criterion view of where you stand while there is still time to fix it, well before it surfaces as exceptions in the draft report.
Evidence with a timestamp and a source
Every artefact carries the system it came from and when it was collected, which is what makes it acceptable as evidence of operation over a period.
Fewer auditor round-trips
The evidence request list is largely answered before it arrives, because it was collected as the period ran.
The same controls carry ISO 27001
Most of a SOC 2 Security control set overlaps ISO 27001 Annex A. Gwenda maps it once, so both certifications run off one programme.
Integrations
Where the evidence comes from
Read-only connections to the systems you already run.
Deputy
Rostered hours against required coverage
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
GitHub
Branch protection and required reviews
Wiz
Cloud misconfiguration and exposure findings
Microsoft Sentinel
Connected data sources and coverage gaps
Microsoft 365
Mailbox and SharePoint sharing
Jira
Incident records with triage and closure times
Humanforce
Rostered hours against required coverage
Okta
Sign-on policies and MFA factors
Microsoft Azure
Subscription role assignments
GitLab
Merge request approval rules
What makes SOC 2 preparation painful is rarely a missing control. The report asks whether controls operated throughout a period, and nobody was collecting the evidence while the period was running.
So the work gets done backwards: three months of reconstruction, chasing screenshots for a window that has already closed. Gwenda inverts that by collecting as it goes.
Questions we get asked
Does Gwenda replace our auditor?
No, and nothing can. A SOC 2 report has to be issued by an independent CPA firm. Gwenda gets you ready for them and keeps you ready between reports, with the evidence already assembled.
Type I or Type II?
Gwenda supports both, but the value is mostly in Type II. A Type I is a point-in-time snapshot; a Type II asks whether controls operated across months, which is exactly the thing continuous collection is good at.
We already have ISO 27001. Does that help?
Considerably. Gwenda maps your existing controls across both, so the overlap is evidenced once. What remains is the delta, and Gwenda shows you exactly what that is.
See what Gwenda finds in your soc 2 posture.
Thirty minutes, your systems or ours. We'll show you what it discovers and where you sit against the gold standard.