SOC 2 with ARRTECH
Records for the criteria in a SOC 2 control matrix.
Records for a SOC 2 examination
A SOC 2 examination tests the organization’s controls against evidence. Monitoring, data-handling and response records help show how those controls were configured and used during the relevant period.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| CC6.7 | Transmission of information restricted. | DLP checks data before it leaves. → |
| CC7.1 | Changes detected. | Each computer’s inventory and changes. → |
| CC7.2 | System components monitored for anomalies. | Events sorted and correlated. → |
| CC7.3 | Security events evaluated. | Case records with history. → |
| CC7.4 | Incidents responded to. | Playbook run history. → |
Transmission
DLP policies can inspect sensitive information on covered transfer paths. Blocking, approval, justification and other DLP responses let the organization protect information while accommodating legitimate work.
Changes
Inventory and configuration records help identify changes on supported computers. Connect significant changes to their approvals and any security review needed.
Anomalies
Common fields and correlation in a SIEM help the team examine related activity across systems. Behavioral context from AI Detection can direct attention to changes, with source evidence retained for the review decision and relevant MITRE ATT&CK mappings.
Response
Repeatable workflows in a SOAR help a team gather evidence and carry out authorized response steps. Decisions requiring review go to the designated person, with the approval and outcome retained in the incident history.
Integrity
Signed records from a SIEM and their verification material let an auditor check integrity outside the original console. The review also considers source accuracy, collection coverage and the meaning of the events.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
CC7.5
Recovery procedures restore affected services and retain evidence of the actions and results.
CC6.8
Malicious software prevented. The DLP process block list is not anti-malware.
CC1
Control environment, which is the organization’s own work.
CC9.2
Vendor risk management.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
CC6.7
Restrict the transmission and movement of information. DLP policies inspect covered transfers and apply the organization’s blocking or approval rules.
CC7.1
Detect configuration changes and new vulnerabilities. Endpoint inventory and change history help the team review the supported computers and changes to them.
CC7.2
Monitor components for anomalies that indicate malicious acts. Correlation in a SIEM connects related events across sources while preserving the records behind the resulting finding.
CC7.3
Evaluate events to decide whether they are incidents. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
CC7.4
Respond to identified incidents with a defined program. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
Questions
Is SOC 2 a certification?
No. It is a CPA’s report on an organization’s controls.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Is there a ready SOC 2 report?
No. Any saved query can run as a scheduled report.
Guide
What is SOC 2?
A CPA’s report on a service organization’s controls, against the Trust Services Criteria.
What are the Trust Services Criteria?
Security, availability, processing integrity, confidentiality and privacy. Security is always in scope.
What is the difference between Type I and Type II?
Type I reports on control design at a point in time. Type II also tests how controls operated over a period.
How ARRTECH takes care of SOC 2 evidence
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
