SOC 2 Type II
SOC 2 assesses controls across the Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy. Gadriel Code provides technical evidence for the Security ("Common Criteria") controls that leave source-code footprints.
Related: Compliance overview · PCI-DSS · HIPAA.
At a glance
| Property | Value |
|---|---|
| Slug | soc2 |
| Aliases | soc-2, soc |
| Controls | 12 |
| Manual-only | 2 |
| Machine-assessable | 10 |
| Direct mapping key | soc2 |
Corpus annotation is still thin. The soc2 key exists on GVL rules and
the vacuous-PASS bug is fixed, so unevidenced controls now correctly show as
PARTIAL rather than silently PASS. Direct rule-to-control annotation is
catching up — expect many PARTIALs on today's reports until coverage improves.
Generating the report
bashgadriel code report --compliance soc2
Outputs: .security/compliance/soc2.{md,typ,pdf}.
What Gadriel evaluates
Common Criteria the scanner touches directly:
- CC6 (Logical & physical access) — authN/authZ misuse, secrets, missing boundary checks.
- CC7 (System operations) — logging, monitoring hooks, incident-response signals in code.
- CC8 (Change management) — CI/CD guardrails, dependency hygiene, SBOM.
- CC9 (Risk mitigation) — vendor / third-party dependency risk.
Rules use compliance_mapping.soc2: CC6.1 (etc.). Two controls are manual-only
and always render as NOT ASSESSABLE.
Working with your auditor
The report is technical evidence for a SOC 2 engagement, not the audit
opinion. Give your auditor the .security/compliance/soc2.pdf alongside your
.security/findings.json and .security/history.rvf so they can trace each
verdict to its underlying finding.