Access and change control that logs itself
ZTNA, secure server access and device control enforce who reaches what. The access records the auditor samples are the enforcement records, not a spreadsheet kept alongside them.
SOC 2
SOC 2, earned by actually being secure.
Most SOC 2 tools automate the paperwork and leave the security to you. Osto ships the controls themselves, then collects the evidence they produce, so the report describes something real.
What it asks for
What an auditor actually opens.
SOC 2 is not a checklist you can buy. It is an opinion from a licensed auditor about whether the controls you described were designed well and, for Type II, whether they ran for the whole observation window.
The five Trust Services Criteria
Security is mandatory. Availability, confidentiality, processing integrity and privacy are in scope only if you claim them. Most startups scope Security alone for their first report, and that is a legitimate choice, not a shortcut.
Common Criteria CC1 to CC9
Governance, communication, risk assessment, monitoring, access control, change management and incident response. The controls are yours to write; the criteria only say what has to be covered.
Evidence, dated and continuous
Type I is a point in time. Type II covers three to twelve months, and the auditor samples across it. A control you turned on the week before the window closes is a finding, not a pass.
Your vendors, not just you
Subservice organisations and vendor reviews are in scope. Enterprise buyers read that section of the report closely, because your suppliers become their suppliers.
How Osto covers it
What Osto brings to the observation window.
Every item below is a module that runs in production, not a policy template. The evidence is a side effect of the control doing its job.
Monitoring that covers the whole window
Continuous threat detection across cloud, network and endpoint, with cloud posture management on AWS, Azure and GCP. CC7 asks whether you would notice; this is the answer.
Vulnerability management with a real test behind it
Expert-led VAPT plus web, mobile and API scanners. A penetration test report is the single most requested artefact in diligence after the SOC 2 letter itself.
Security questionnaires answered from your own posture
The questionnaire is where a SOC 2 report gets used. Answers come from what the platform actually sees, so they stay true between audits.
Every module named above is on the platform page, with a short demo of each.
The honest difference
Compliance automation, and what it leaves on your desk.
This is a real distinction, not a swipe. Compliance-automation platforms are good at what they do. They just start from the assumption that your security stack already exists.
A compliance tool alone
- Connects to tools you already run and reads their state
- Tracks policies, training and vendor reviews
- Tells you a control is missing
- Leaves you to buy, deploy and operate the control
- Leaves the penetration test to a separate vendor
Osto
- Ships the control, so there is something to read the state of
- Tracks the same policies, training and vendor reviews
- Closes the gap instead of reporting it
- Runs the control in production, on your cloud and your endpoints
- Includes expert-led VAPT in the same engagement
SOC 2 library
Everything we have written about SOC 2.
Written by the team that runs the controls, not a content desk.
Start here
Type I or Type II
Controls and evidence
- SOC 2 controls explained: CC1 to CC9 and the Trust Services Criteria
- SOC 2 evidence collection: what auditors actually want
- SOC 2 evidence by control: what auditors actually ask for
- What compliance automation cannot collect: the SOC 2 evidence gap
- SOC 2 policies and documentation: the complete list for startups
Running the project
Questions
The things founders ask first.
How long does a SOC 2 report take?
Type I can be a few weeks once controls are in place. Type II needs an observation window, usually three months for a first report and twelve thereafter, and the window cannot be compressed. The honest answer is that the audit is short and the readiness work in front of it is not.
Do we need Type I first?
No. Type I exists so you have something to show a buyer while the Type II window runs. If nobody is asking yet, going straight to Type II saves an audit fee. If a deal is blocked today, Type I unblocks it.
Is SOC 2 mandatory?
Not by law anywhere. It is mandatory in practice the moment an enterprise buyer or a security review asks for it, which is why it usually arrives as a sales blocker rather than a compliance project.
Can Osto issue the SOC 2 report?
No, and nobody who sells you software can. The report comes from a licensed CPA firm. Osto runs the controls and produces the evidence the auditor samples, and we work alongside whichever firm you pick.
We already use a compliance automation tool. Does Osto replace it?
It can, and it often does, because the overlap is large. The part that does not overlap is the security tooling: WAF, CSPM, ZTNA, EDR and VAPT are things Osto runs rather than monitors. Talk to us about what you have before you decide.
Get SOC 2 ready the way it actually works.
Thirty minutes, your stack on screen, an honest read on what is already in place and what is not.