SOC 2 assessment
VeriProof saves an assessment for six SOC 2 Trust Services Criteria. It lines up what an application recorded with the control evidence your organization holds, for access, monitoring, and change.
A saved assessment is not an auditor’s opinion or a SOC 2 report. Your organization defines its system boundary, and your auditor evaluates its controls.
For VeriProof’s own report status, see SOC 2 status.
What the assessment covers
The criteria come from the 2017 Trust Services Criteria, with the revised points of focus from 2022. VeriProof describes each one in its own words.
| Criterion | Recorded application facts | Organization evidence |
|---|---|---|
| CC6.1: Logical access security | Current access grants and attributed actors | Access control policy and proof that restrictions operate |
| CC6.2: Registration and authorization of users | Current access grants | Provisioning procedure and approval records |
| CC6.3: Access modification and removal | Current access grants | Access reviews and records of changed or removed access |
| CC7.2: System monitoring | Verified activity records, active rules, and rule checks | Monitoring procedures and the analysis of anomalies |
| CC7.3: Security event evaluation | Archive digests and rule checks | Event evaluation procedure, conclusions, and follow-up |
| CC8.1: Change management | Exact active rule versions | Change procedure with authorization, testing, and approval records |
Each criterion also needs a system-boundary decision. It records the system description that includes this AI system and whether the criterion applies. VeriProof does not infer it from the framework you assigned, session volume, or the application’s data tier.
Review a saved assessment
Open the application
Open the application, then select Compliance. SOC 2 must be one of the application’s frameworks.
Select the assessment period
Choose the dates to review. The assessment uses activity that started in that period.
Open the SOC 2 assessment
Select Review SOC 2 assessment. Each criterion lists its recorded facts, what is missing, and the next step.
Add organization evidence
Select Organization evidence. An Administrator or Compliance Officer adds a PDF for a criterion and requests a review. A reviewer approves or rejects it. The system boundary is reviewed separately.
Export the assessment
Download the assessment record or send the SOC 2 evidence summary to a connected GRC platform such as Vanta or ComplyAssistant. Verify the archive before you deliver it.
Requirement states
Each requirement shows one state, so you can see who acts next.
| State | What it means |
|---|---|
| Organization evidence needed | No evidence is approved yet. Add a PDF and request a review. |
| Evidence awaiting approval | A reviewer approves or rejects the submitted evidence, then VeriProof reassesses the requirement. |
| Accountable review needed | A recorded review is waiting for an accountable reviewer to approve or reject it. |
| Met | The organization evidence has a current approval. |
| Not assessed for these dates | The requirement has no result for the selected dates. Run an assessment for them. |
| Observations only | VeriProof summarizes recorded activity for the framework but does not assess the requirement. |
Partially met, Not met, and Contradicted by recorded activity are decided results. Open the requirement to see the evidence behind them.
Resolve rule problems
When an application has no active rule, or its rule checks fail, VeriProof opens one work item for that problem. The HIPAA, ISO/IEC 42001, EU AI Act, and SOC 2 assessments share it, so you resolve it once.
Keep the rest of your examination evidence
Your SOC 2 description, remaining criteria, and the operation of controls across the examination period stay in your GRC record. The assessment covers six criteria for one application and period.