SOC 2 · Trust Services Criteria

SOC 2 compliance software for companies that already run a management system

Map the SOC 2 Trust Services Criteria to the same controls you use for ISO 27001, collect evidence on a schedule with department approval, and let connectors check identity, devices and backups automatically.

Book a free demo See all applications

Why SOC 2 becomes a second, parallel programme

Clients in the US and Europe increasingly ask suppliers and service providers for a SOC 2 report. Teams that already hold ISO certificates often start SOC 2 as a separate project with separate spreadsheets.

Most SOC 2 requirements overlap with ISO 27001 and good QMS practice: access control, change management, risk assessment, vendor management, incident response.

Zefron maps SOC 2 to a shared control library, so a control assessed once counts for SOC 2, ISO 27001 and the other frameworks you follow, with evidence and approvals kept in one place.

SOC 2 features

Shared controls

SOC 2 criteria mapped to one control library
Assess once, counts for ISO 27001, GDPR and others
Owner, status and target date per control
Full change history

Evidence

Evidence calendar by department and period
Reviewer and department-head approval
Automatic evidence from connectors
Read-only auditor access

Supporting processes

Change management with ECN
Vendor risk with questionnaires and certificates
Risk register and incident handling
Policy reading tracked per person

Monitoring

Microsoft 365, Okta, Intune, AWS, Azure, GitHub checks
Failed checks raise an alert and a ticket
Health score per department
Monthly board report

Spreadsheets vs enterprise QMS vs Zefron

How the three common approaches compare.

	Excel and shared folders	Enterprise QMS suites	Zefron QMS Portal
Set-up time	Ready today, but rebuilt for every audit	Months of project work and consultants	Configured for you; most go live in two to four weeks
Approvals	E-mail threads, signatures on paper	Fixed workflows, changes need IT	Review and department-head approval on every action
Version control	Old copies stay in use	Yes	Only the current version is visible; full history kept
Audit trail	None	Yes	Every action with name, date and time
Reminders and overdue tracking	Manual	Yes	Automatic e-mail reminders and dashboards
Data entered once	Copied between files	Often separate modules	Linked across documents, 8D, audits, PPAP and quality tools
Cost	Low licence cost, high staff time	High licence and implementation cost	Priced for small and mid-size companies

Free downloads: 8D, CAPA, PPAP and audit checklist templates →

Trust Services Criteria covered

The portal helps you prepare for and operate controls; a SOC 2 report is issued only by an independent CPA firm.

Requirement	How the portal supports it
Security (common criteria CC1 to CC9)	Governance, risk assessment, logical access, operations, change management, vendor risk.
Availability	Backup and recovery evidence, monitoring results.
Confidentiality and privacy	Data handling, processors, retention and data requests through the privacy toolkit.

Live in three steps

Configure

We switch on SOC 2, map it to your existing controls and agree owners.

Migrate

Gaps get target dates; the evidence plan and connectors are set up.

Train & go live

Evidence accumulates with approvals over your observation period, ready for your auditor.

Frequently asked questions

Do you issue SOC 2 reports?

No. Reports are issued by independent CPA firms. Zefron organises the controls and evidence your auditor will test.

We already have ISO 27001. How much is extra?

Usually little: most SOC 2 criteria map to controls you already assess. The shared library shows the remaining gaps.

Can evidence cover a Type II period?

Yes. Evidence is dated and kept with its approval history, so you can show controls operating across the observation period.

Which integrations are available?

Microsoft 365, Intune, Azure, AWS, Okta, GitHub, FortiGate, Endpoint Central and Veeam, plus a URL any system can post results to.