SOC 2 in plain terms
SOC 2 is an attestation report on how a company protects customer data. An independent auditor, a licensed CPA firm, examines your controls against the Trust Services Criteria published by the AICPA and writes a report you can share with customers.
Security is the one criterion every SOC 2 report covers. Availability, processing integrity, confidentiality, and privacy are optional, and are added when they matter to your customers. Startups usually meet SOC 2 when a larger customer's security review asks for it.
Type I and Type II
A Type I report looks at whether your controls are designed properly at a point in time. A Type II report looks at whether they operated effectively over a period, commonly three to twelve months.
Type II is the reason monitoring matters. Saying you watch for security events is not enough. You have to show that you did, across the whole period.
What an auditor asks about security operations
Among the security criteria, the system operations requirements cover how you detect, evaluate, and respond to security events. In practice an auditor asks questions like these.
- How do you detect security events in your systems?
- How do you decide which events are incidents?
- How do you respond, and who approves it?
- Can you show records of that happening during the audit period?
What Jutsu contributes
Jutsu does the monitoring, investigation, and response work, and keeps the record of it. On every paid plan, its Compliance module also sets up the program around that work.
- Monitoring: connected Google Cloud, AWS CloudTrail, Google Workspace, GitHub, Windows, Linux, and macOS host, Cloudflare, Vercel, and Railway sources are watched around the clock.
- Triage and investigation: each alert gets a category, severity, risk score, and verdict, and uncertain ones are escalated to a person.
- Response records: every AgentSOAR execution is recorded with its status, and approval-based response is included from the Startup plan.
- Reports: incident reports and SOC activity reports, daily and weekly on the Startup plan.
- Posture checks: read-only compliance posture checks, run every day, for connected Google Cloud projects and Google Workspace domains, and osquery on Windows, Linux, and macOS hosts, on every paid plan.
- Policies: setup asks 13 short questions, then drafts every policy your frameworks need. Your team fills the blanks, approves, and publishes them.
- Evidence tasks: recurring monthly, quarterly, and yearly tasks, with each period kept as its own record, and a readiness score that counts finished work. Growth adds continuous compliance evidence and compliance dashboards.
- Audit support: read-only access for your auditor, limited to the frameworks and dates you choose, a public trust center, and AI-drafted answers to customer security questionnaires that you approve.
- Frameworks: SOC 2, ISO/IEC 27001, ISO/IEC 42001, ISO 9001, HIPAA, GDPR, PCI DSS, CCPA/CPRA, CIS Controls (IG1), NIST CSF, NIS2, Essential Eight, and Cyber Essentials, all on every paid plan.
What stays with you and your auditor
Jutsu sets up the program and does the security work, but people make the decisions. Nothing setup creates is published, assigned, or accepted until someone on your team acts on it.
Jutsu does not issue SOC 2 reports and does not guarantee an audit outcome.
- Filling in, approving, and publishing your policies.
- Doing each period's evidence work and closing it on time.
- Deciding which risks and vendors apply, and how to treat them.
- People controls such as onboarding and offboarding.
- Choosing an auditor, scoping the report, and the audit itself.
How this differs from a compliance-only tool
A compliance-only platform is organized around the audit: policies, checklists, and collecting proof. Jutsu's Compliance module does that job, and Jutsu also runs the security work itself, so the monitoring and response your policies promise actually run and leave a record you can show.