BY NEURABYTE
FRAMEWORKS/SECURITY/SOC 2
SOC2
SECURITY · AICPA

SOC 2

The report most enterprise buyers ask for first.

SOC 2 is an attestation report, not a certification. An independent CPA firm examines your controls against the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) and issues an opinion. Type I covers design at a point in time; Type II covers operation over a period, usually six to twelve months.

AT A GLANCE
ISSUERAICPA REGIONUnited States, used globally CATEGORYSecurity CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01SaaS and infrastructure vendors selling to mid-market and enterprise buyers
02Any team whose customers send security questionnaires before signing
03Companies preparing for ISO 27001 later, since the control sets overlap heavily
02. KEY REQUIREMENTS

The parts of SOC 2 that touch what agents do.

CC6 Logical access
Access is granted on least privilege, reviewed, and removed on termination. Privileged actions are restricted and logged.
CC7 System operations
Anomalies are detected, incidents are responded to, and the audit trail is complete enough to reconstruct what happened.
CC5 Control activities
Segregation of duties: the person who requests a change is not the person who approves it.
CC8 Change management
Changes to systems and data are authorized, tested, and documented before they take effect.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against SOC 2. Where there is no evidence, the report says gap.

LORE CONTROL SOC 2 REFERENCE
Blocking authorization gateCC6.1, CC6.3
Maker–checker approvalCC5.2, CC8.1
Signed, hash-chained receiptsCC7.2, CC7.3
Provable deletionC1.2
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Vendor management, HR onboarding, and physical security controls live outside Lore and are marked out of scope.
The audit opinion itself comes from your CPA firm. Lore produces evidence; it does not attest.
05. QUESTIONS
Does Lore make us SOC 2 compliant?
No. Lore gives your auditor signed evidence for the technical controls it enforces. The remaining criteria, and the opinion, are yours and your auditor's.
Type I or Type II?
Most buyers accept a Type I to start and expect a Type II within a year. Because receipts accumulate continuously, the observation period for Type II is already being recorded from day one.
Which criteria does Lore cover best?
Security (CC6, CC7) and the change and approval controls in CC5 and CC8. Availability and processing integrity depend on your infrastructure.
← PREVIOUSInternal control sets ALL FRAMEWORKS NEXT →ISO 27001
SOC 2 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for SOC 2 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.