SOC 2 Trust Services Criteria, Attestix coverage

The AICPA SOC 2 Trust Services Criteria (TSC 2017 with 2022 Revised Points of Focus) are the framework an independent CPA firm uses to perform a SOC 2 examination of a service organisation. This page shows how Attestix's signed audit chains, Verifiable Credentials, and provenance records map to the TSC, focused on the technology-heavy criteria (Common Criteria CC1-CC9 and Processing Integrity PI1) where chain-hashed evidence is most useful.

Why this matters

SOC 2 is an attestation, not a certification. This distinction is load-bearing:

• A certification (ISO 27001, ISO 42001) is a binary YES/NO awarded by an accredited certification body. The organisation displays a cert mark.
• An attestation (SOC 2) is a CPA firm's professional opinion on whether the service organisation's controls were suitably designed (Type I) or designed and operating effectively (Type II) to meet the relevant Trust Services Criteria over a stated audit period. The deliverable is a SOC 2 report (~80 to 200 pages) with a one-page CPA opinion letter on top.

Attestix does not ship SOC 2 attestations and is not a CPA firm. We do not issue an opinion. What Attestix ships is the evidence plumbing your CPA's auditor can use during your own SOC 2 examination, particularly for the technology-heavy criteria where signed audit trails + chain-hashed event logs + cryptographic identity reduce auditor evidence-gathering by weeks.

The honest coverage table

The TSC 2017 has 64 criteria total. The table below covers 30 representative criteria focused on Common Criteria (CC1-CC9, the Security category required for every SOC 2 report) and Processing Integrity (PI1, the entire category, the strongest Attestix-aligned area).

Tally (across all 64 criteria)

• evidence-substrate (Attestix produces signed evidence your auditor can examine): 27
• record-only (Attestix signs your operator's assertions): 18
• out-of-scope (organisational + cultural CC1 + physical CC6.4-CC6.5 + most of Privacy P1-P8 territory): 19

Concentrated where it matters most for SOC 2: Security CC6 (logical access via UCAN + DID), CC7 (system operations via chain-hashed events), CC8 (change management via provenance) and Processing Integrity PI1 (the entire category).

Important caveat: security_check_id ships in v0.5.0. As of Attestix v0.4.0 the underlying events are emitted today, but they are NOT yet tagged with the soc2.* discriminator. The v0.5.0 release registers the prefix in FRAMEWORK_REGISTRY; per-criterion emission tagging is incremental.

What we don't do

• We do not issue SOC 2 reports. The CPA firm performing your examination is the only entity that issues SOC 2 reports.
• We do not author your policies. Policy authorship lives in your DMS, with Vanta / Drata / Secureframe templates, or with internal counsel.
• We do not shepherd your SOC 2 readiness end-to-end. That is what compliance platforms (Vanta, Drata, Secureframe, Strike Graph, AuditBoard) do: auditor coordination, employee training, evidence collection workflows, continuous monitoring dashboards. They sit above the evidence layer; we sit below. The two stack.
• We do not do physical security (CC6.4-CC6.5). Your data-centre operator's SOC 2 carve-out covers that.
• We are not your IAM enforcement layer. We record who attempted what; your Okta / Auth0 / Entra IAM enforces access policies.
• We are not your SIEM. We produce signed forensic evidence; your Splunk / Datadog / Honeycomb ingests + dashboards.

How to verify our coverage yourself

Python / CLI

# List every audit event tagged with a SOC 2 criterion (v0.5.0+)
attestix audit list --security-check soc2.security.CC6_3.access_granted

# Export a bundle scoped to SOC 2 evidence for your auditor (v0.5.0+)
attestix bundle export --controls soc2 --out my-soc2-evidence.atxbundle

# Verify chain integrity for an agent's audit log (today)
attestix verify-chain <agent-did>

JavaScript / browser

npm install attestix

import { verifyCredential } from "attestix";

const result = await verifyCredential(securityCheckCredentialJson);
// result.valid === true if the Ed25519 signature over the JCS-canonical body
// matches the issuer DID's public key.

On-chain anchor (Base L2 Sepolia testnet)

attestix anchor audit-batch --agent <did> --network base-sepolia

Mainnet schema registration is planned; testnet is the default target today.

Comparable disclosure

How other tools position themselves on SOC 2.

See also

• OWASP Top 10 for Agentic Applications mapping
• ISO/IEC 42001:2023 mapping
• NIST AI RMF 1.0 mapping
• FRIA template (EU AI Act Art 27)
• The internal mapping spec at attestix-cloud-plan/25-SOC2-MAPPING.md.

Attestix is evidence tooling a customer's auditor can use during the customer's own SOC 2 examination. Attestix does not issue SOC 2 attestations, is not a CPA firm, and a passing tag against a Trust Services Criterion is one signal among many in the audit, and the auditor's professional opinion is the authoritative output. Compliance platforms like Vanta, Drata, Secureframe, and Strike Graph shepherd the end-to-end SOC 2 readiness journey; we slot underneath them as the cryptographic evidence layer.