SchildmarkSOC 2
SOC 2: evidence for CC6.8 and CC7, for every day of the Type II period
A Type II report asks whether your controls operated throughout the period, not whether they exist. Schildmark runs the monitoring, response and patching the Common Criteria ask about, and keeps the record for every day of it.
What the criteria ask for on the technical side
SOC 2 reports against the AICPA 2017 Trust Services Criteria, with points of focus revised in 2022; the criteria themselves did not change. Most of the technical work sits in the Common Criteria below.
- CC6.8
- Prevent or detect, and act on, unauthorised or malicious software.
- CC7.1
- Detect configuration changes that introduce vulnerabilities, and susceptibility to newly discovered vulnerabilities.
- CC7.2
- Monitor system components for anomalies that indicate malicious acts, natural disasters or errors.
- CC7.3
- Evaluate security events to decide whether they are incidents.
- CC7.4, CC7.5
- Respond to incidents with a defined programme, and recover from them.
- CC8.1
- Authorise, test, approve and implement changes to infrastructure and software.
Type I
Are the controls suitably designed, at one point in time? A description and a design opinion.
Type II
Did they operate effectively throughout a period, of up to twelve months? The auditor samples from the whole period, so records must exist for every day of it.
Criterion, what Schildmark does, and the evidence
Detection rules tag their alerts with Trust Services Criteria, and the compliance page counts them per criterion for the period you choose.
| Requirement | What Schildmark does | Evidence it produces |
|---|---|---|
| CC6.8 | Not an anti-malware product. Microsoft Defender for Endpoint and Sophos Central alerts, and file integrity changes from the monitoring agent, arrive in one list. | Alerts tagged with the criterion. |
| CC7.1 | CIS configuration checks on every machine, read again every 10 minutes; vulnerable packages corroborated against vendor and NVD data. | configuration_checks.csv, configuration_scores.csv |
| CC7.2 | Machines, network sensors, firewalls, Microsoft 365, AWS and Google Cloud in one list, with one severity scale. | controls.csv: alerts and machines per criterion in the period. |
| CC7.3 | Each alert opens with its rule, MITRE technique, machines and log line; ask the analyst; a mute needs a classification and a reason. | Mutes with their reasons in the audit trail. |
| CC7.4 | Block on your own firewall from the alert, a rule or the analyst; rules can wait for approval; protected addresses are never blocked. | audit_trail.csv |
| CC7.5 | Only in part: the vulnerability an attacker used can be fixed and verified as fixed. Restoring your systems and data is yours. | vulnerabilities_fixed.csv |
| CC8.1 | For patches only: each change is planned, rehearsed, approved (two people for critical machines), installed in the maintenance window and verified. | patch_activity.csv |
Because a Type II period can run to twelve months, the compliance page warns when logs are kept for less than 365 days, and the README in the evidence pack names the shortfall. More on detection, verified patching, the compliance page and evidence pack, and in the documentation: Compliance, Patching.
What Schildmark does not cover
A SOC 2 report covers your whole control environment. These parts stay with you and your auditor.
- CC1 to CC5
- Control environment, communication, risk assessment, monitoring of controls and policies.
- CC6.1 to CC6.7
- Logical and physical access to your systems. Alerts tagged CC6.1 can support it; the access management is yours.
- CC9
- Vendor and business partner risk, and business disruption.
- Other categories
- Availability, confidentiality, processing integrity and privacy, if they are in scope.
- The report
- Your system description, and the examination by a CPA firm.
How a rollout looks
Usually days, not months. Nothing needs to be installed on your firewalls.
Choose where it runs
Hosted by us, or on one or two of your own Linux servers. Either way, you get a stack of your own.
Enrol the machines
One command per machine on Windows, macOS and Linux, or an MSI for Intune, Configuration Manager or Group Policy.
--patchingadds patching.Connect the rest
Firewall logs, Microsoft 365, AWS and Google Cloud, and the firewalls you block on, set up in the console.
Choose SOC 2, set 365 days
Turn on SOC 2 on the compliance page, keep logs for at least 365 days, and export the evidence pack for the period your auditor tests.
Questions people ask
What is the difference between SOC 2 Type I and Type II?
A Type I report describes your system and says whether the controls are suitably designed at one point in time. A Type II report also tests whether they operated effectively throughout a period, so the auditor samples evidence from across that period, not just from the day of the audit.
How long is a SOC 2 Type II period?
It is agreed with your auditor and can cover up to twelve months. Records have to exist for the whole period, which is why Schildmark warns when logs are kept for less than 365 days.
Does SOC 2 require antivirus?
CC6.8 asks for controls that prevent or detect, and act on, unauthorised or malicious software. It names no product. Most organisations meet it with anti-malware on their machines plus monitoring that someone reviews; Schildmark is the second part, not the first.
Which SOC 2 criteria does security monitoring cover?
Mainly CC7.2, monitoring system components for anomalies, and CC7.3, evaluating security events to decide whether they are incidents. CC7.1 covers configuration and vulnerability monitoring, and CC7.4 the response to incidents.
Did the 2022 revision change the SOC 2 criteria?
No. In 2022 the AICPA revised the points of focus; the 2017 Trust Services Criteria themselves did not change. Points of focus help you design and evaluate controls; they are not separate requirements.
Starting a Type II period?
Tell us when your observation period starts and what is in scope. We will show you the evidence Schildmark keeps from day one. Priced per protected machine.