Frameworks · SOC 2 Type II · attestation, not certification
Type I is a photograph. Type II is a film.
Nobody certifies you. An auditor watches your controls run for months and writes down what happened — including the frames where something went wrong. That record is worth more than a badge, and it expires.
Twelve months of operation, one frame each. The eleventh frame is an exception the auditor found and listed by name — which is what a serious reader looks for, because a report with none often means nobody looked.
The cheaper report
A single frame, sold as the whole reel
Type I confirms your controls were designed properly on one date. It says nothing about the next morning — and it takes weeks rather than months, which is precisely why it gets presented as though it were the other thing.
Asiri prints the type on the badge. Not because Type I is worthless, but because a buyer who discovers the difference themselves stops reading the rest of your page.
Type I · one date
1 Apr
Design of controls, as at this date. No period. No exceptions list, because nothing was observed running.
The window
Your report has ninety-four days left
The logo window closes twelve months from the report date, not twelve months from when you started work. Asiri counts down from the date on the report and stops the badge showing as current the day it lapses.
94 days
Which means the next observation period has to open before this one expires. Companies that treat the report as an annual event rather than a rolling one spend two months of every year with nothing to send.
Five trust services criteria
One is compulsory. The other four are a choice you are making right now.
Tap them. Every SOC 2 report covers Security, and a report covering only Security is far narrower than most buyers assume. Whatever you pick, Asiri prints the scope on the badge rather than leaving it to be discovered.
Security
The common criteria. Always in, which is why including it proves nothing on its own.
Availability
Uptime commitments and the capacity planning behind them. Asked for by anyone whose own service depends on yours.
Confidentiality
How information designated confidential is protected, shared and destroyed.
Processing integrity
That processing is complete, valid, accurate and timely. Rarely elected, frequently assumed.
Privacy
Notice, choice and disposal. Overlaps the Act heavily — and is the one most reports leave out.
SOC 2 Type II · Security and Availability · period ending 1 Apr
2 of 5 criteria in scope.Where your NDPA work lands
2 of the 4 common criteria listed here are already evidenced
Access, change management, incident response, vendor diligence — the Act made you evidence all four. What SOC 2 adds is that the evidence must be continuous, which is a scheduling problem rather than a new collection. These four are the criteria your registers already speak to and not the whole common-criteria series, and the two marked partial name what is missing rather than rounding themselves up.
CC6 Logical access
Already metYour access register, and the same identity read that answered the Act on organisational measures.
CC7 System operations
Already metThe incident register, with the notification timestamps the 72-hour clock produced.
CC8 Change management
PartialPeer review is evidenced. Emergency-change approvals still live in chat rather than the register.
CC9 Risk mitigation
PartialVendor diligence exists for seven of nine suppliers — the same two gaps that fail the Act.
The exceptions list is the point
A clean report is not the same as a good one
Two exceptions found, described, and remediated reads better to an experienced reviewer than a report with none — because a period with zero findings usually means the testing was thin. Asiri keeps the findings attached to the controls they came from.
Report A · findings
None
Nothing found — or nothing tested
A reviewer
trusts B
Report B · findings
Two
Both remediated and retested in period
Chain of custody · every finding carries its own dates
EX-01
Two leavers retained access for nine days
Offboarding now triggers from the HR record rather than a ticket.
EX-02
Four emergency changes approved after deployment
Permitted by policy — the policy did not require a retrospective record. It does now.
Never printed
SOC 2 certified
Printed instead
SOC 2 Type II · Security and Availability · period ending 1 Apr
Available under NDA. No certificate exists; no registrar issued one.
The window opens the day your evidence becomes continuous
Which means the sooner collection is automatic, the sooner the clock can start. Asiri tells you the earliest honest start date, and it is usually sooner than a consultant will.