SOC 2 Trust Services Criteria — Attestix coverage

The AICPA SOC 2 Trust Services Criteria (TSC 2017 with 2022 Revised Points of Focus) are the framework an independent CPA firm uses to perform a SOC 2 examination of a service organisation. This page shows how Attestix's signed audit chains, Verifiable Credentials, and provenance records map to the TSC — focused on the technology-heavy criteria (Common Criteria CC1-CC9 and Processing Integrity PI1) where chain-hashed evidence is most useful.

Why this matters

SOC 2 is an attestation, not a certification. This distinction is load-bearing:

• A certification (ISO 27001, ISO 42001) is a binary YES/NO awarded by an accredited certification body. The organisation displays a cert mark.
• An attestation (SOC 2) is a CPA firm's professional opinion on whether the service organisation's controls were suitably designed (Type I) or designed and operating effectively (Type II) to meet the relevant Trust Services Criteria over a stated audit period. The deliverable is a SOC 2 report (~80-200 pages) with a one-page CPA opinion letter on top.

Attestix does not ship SOC 2 attestations and is not a CPA firm. We do not issue an opinion. What Attestix ships is the evidence plumbing your CPA's auditor can use during your own SOC 2 examination — particularly for the technology-heavy criteria where signed audit trails + chain-hashed event logs + cryptographic identity reduce auditor evidence-gathering by weeks.

The honest coverage table

The TSC 2017 has 64 criteria total. The table below covers 30 representative criteria focused on Common Criteria (CC1-CC9, the Security category required for every SOC 2 report) and Processing Integrity (PI1, the entire category — the strongest Attestix-aligned area).

Tally (across all 64 criteria)

• evidence-substrate (Attestix produces signed evidence your auditor can examine): 27
• record-only (Attestix signs your operator's assertions): 18
• out-of-scope (organisational + cultural CC1 + physical CC6.4-CC6.5 + most of Privacy P1-P8 territory): 19

Concentrated where it matters most for SOC 2: Security CC6 (logical access — UCAN + DID), CC7 (system operations — chain-hashed events), CC8 (change management — provenance) and Processing Integrity PI1 (the entire category).

Important caveat — security_check_id ships in v0.5.0. As of Attestix v0.4.0 the underlying events are emitted today, but they are NOT yet tagged with the soc2.* discriminator. The v0.5.0 release registers the prefix in FRAMEWORK_REGISTRY; per-criterion emission tagging is incremental.

What we don't do

• We do not issue SOC 2 reports. The CPA firm performing your examination is the only entity that issues SOC 2 reports.
• We do not author your policies. Policy authorship lives in your DMS, with Vanta / Drata / Secureframe templates, or with internal counsel.
• We do not shepherd your SOC 2 readiness end-to-end. That is what compliance platforms (Vanta, Drata, Secureframe, Strike Graph, AuditBoard) do — auditor coordination, employee training, evidence collection workflows, continuous monitoring dashboards. They sit above the evidence layer; we sit below. The two stack.
• We do not do physical security (CC6.4-CC6.5). Your data-centre operator's SOC 2 carve-out covers that.
• We are not your IAM enforcement layer. We record who attempted what; your Okta / Auth0 / Entra IAM enforces access policies.
• We are not your SIEM. We produce signed forensic evidence; your Splunk / Datadog / Honeycomb ingests + dashboards.

How to verify our coverage yourself

Python / CLI

# List every audit event tagged with a SOC 2 criterion (v0.5.0+)
attestix audit list --security-check soc2.security.CC6_3.access_granted

# Export a bundle scoped to SOC 2 evidence for your auditor (v0.5.0+)
attestix bundle export --controls soc2 --out my-soc2-evidence.atxbundle

# Verify chain integrity for an agent's audit log (today)
attestix verify-chain <agent-did>

JavaScript / browser

npm install attestix

import { verifyCredential } from "attestix";

const result = await verifyCredential(securityCheckCredentialJson);
// result.valid === true if the Ed25519 signature over the JCS-canonical body
// matches the issuer DID's public key.

On-chain anchor (Base L2 Sepolia testnet)

attestix anchor audit-batch --agent <did> --network base-sepolia

Mainnet schema registration is planned; testnet is the default target today.

Comparable disclosure

How other tools position themselves on SOC 2.

See also

• OWASP Top 10 for Agentic Applications mapping
• ISO/IEC 42001:2023 mapping
• NIST AI RMF 1.0 mapping
• FRIA template (EU AI Act Art 27)
• The internal mapping spec at attestix-cloud-plan/25-SOC2-MAPPING.md.

Attestix is evidence tooling a customer's auditor can use during the customer's own SOC 2 examination. Attestix does not issue SOC 2 attestations, is not a CPA firm, and a passing tag against a Trust Services Criterion is one signal among many in the audit — the auditor's professional opinion is the authoritative output. Compliance platforms like Vanta, Drata, Secureframe, and Strike Graph shepherd the end-to-end SOC 2 readiness journey; we slot underneath them as the cryptographic evidence layer.