21RISK is SOC 2 compliance software for the team that owns the programme. Adopt the 61 trust services criteria ready-made, write each control once, keep your policies approved and collect evidence for every quarter of a Type 2 period. Since October 2026 we run our own SOC 2 programme this way.
SOC 2 sits next to your other frameworks in Frameworks and Controls. Each section shows how many of its criteria have a control. A category outside your report is marked not applicable, with the reason on record. Open a section to see which controls cover each criterion, and which criteria still need one.
Writing the controls is the smaller part. The work is to show, month after month, that each one was carried out and who approved it.
A Type 2 report covers months, not a day. An access review that was done but never filed is hard to prove afterwards. One that was skipped cannot be repaired.
The criteria and controls sit in a matrix, the policies in a shared drive and the open points from the last audit in email. Which controls does this policy cover? Someone has to remember.
A customer asks for ISO 27001, or NIS2 applies to you. Most of the controls are the ones you already run for SOC 2, but they get described again in a new file.
Start from the criteria, describe what you actually do, and let the recurring work come back by itself.
Add SOC 2 in Frameworks and Controls: the 61 trust services criteria, with 38 suggested controls already mapped. Mark the categories outside your report as not applicable, with the reason.
Edit the suggested controls to match what you do, add your own and give each an owner. Upload each policy, link the controls it covers and approve it. The approval is recorded.
Set up a findings board for evidence. Each task comes back every quarter, or at the interval you choose, and can require a new file before it is completed. Your auditor’s findings go on a board too.
We have held a SOC 2 Type 2 report since 2024. Since October 2026 our own SOC 2 programme runs in 21RISK, on the same boards you would use. The move is recent, so read this as how we work today, not as an audit result.
Our SOC 2 framework holds all 61 criteria. 38 are in scope, and each of them has a control. The other 23 are marked not applicable, each with its reason. We keep more than 150 controls and more than 30 approved policies.
Evidence tasks, vendor reviews, the risk register, auditor findings and change requests are findings boards we set up ourselves. NIS2 and ISO 14001 run in the same organization, on the same controls.
The 5 findings boards are ordinary boards. We set them up ourselves.
The 2017 Trust Services Criteria as reference codes and short titles. Paste the AICPA text you license into your copy. Everything stays editable.
SCOPEA criterion or a whole category outside your report stays on record with its reason and leaves the coverage count.
POLICIESKeep the document, the owner and the controls it covers. 21RISK records who approved it and on which day, and keeps every replaced version.
APPROVALSDecide which user group may move an item to a status, such as Completed. That keeps the person who prepares the evidence apart from the one who approves it.
Give an outside auditor a login. They see only the boards you open to them.
Connect Claude or another assistant through the MCP server. Your own scripts can attach evidence files through the REST API.
Every framework, control and policy operation is in the REST API and the MCP server. Changes an assistant proposes in the in-app chat wait for your approval.
A control is written once and mapped to every requirement it meets. All 38 suggested controls for SOC 2 are also mapped to ISO 27001, and 34 of them to NIS2. Adopt the second framework and the controls you already have are linked, not created again.
ISO/IEC 27001:2022 with 119 requirements, ready to adopt next to SOC 2.
STANDARDS64 requirements from the directive and its implementing regulation, ready to adopt next to SOC 2.
COMPLIANCEHow frameworks, controls, policies and findings fit together in 21RISK.
See how frameworks and controls work, how policies are approved and reviewed, and how findings are followed up to closed.
No. A SOC 2 report is issued by an independent audit firm. 21RISK is not an audit firm and has no auditor marketplace, so you choose your own auditor. 21RISK holds what the auditor asks for: the criteria, your controls, the approved policies and the evidence for each period.
No. 21RISK does not connect to your cloud accounts, your code hosting or your identity provider. People attach the evidence to the task it belongs to, or your own scripts attach files through the REST API.
A Type 1 report looks at your controls on one date. A Type 2 report looks at whether they worked over a period, so the evidence has to exist for the whole period. In 21RISK an evidence task can come back every number of days, weeks, months or years. With fixed periods, such as calendar quarters, it must be closed once per period, and a Files attached rule on the closing status can require a new file in that period. The task then shows its history period by period: the dates, the last status, and the files and comments added.
All five, 61 criteria in total: 33 common criteria for Security (CC1 to CC9), 3 for Availability, 2 for Confidentiality, 5 for Processing Integrity and 18 for Privacy. The 38 suggested controls cover Security, Availability and Confidentiality well. 22 criteria have no suggested control: all of Processing Integrity, most of Privacy, and CC2.1 and CC5.2. Mark a category outside your report as not applicable, with the reason, or write your own controls for it.
No. The Trust Services Criteria are licensed by the AICPA. The template follows the 2017 criteria with the 2022 revised points of focus, as reference codes and short titles in our own words. You paste the text you license into your copy, and everything in your copy stays editable.
No. A control is written once and mapped to requirements in any number of frameworks. All 38 suggested controls for SOC 2 are also mapped to ISO/IEC 27001:2022, and 34 of them to NIS2. When you adopt the second framework, the suggested controls you already have are linked to its requirements instead of being created again.
Yes. Give an outside auditor a login, and they see only the boards you open to them. Their findings can go on a findings board, each linked to the control it affects, with an owner, a due date and its history.
Yes. We have held a SOC 2 Type 2 report since 2024, and since October 2026 our own SOC 2 programme runs in 21RISK: the framework, the controls, the policies, the evidence tasks, the vendor reviews, the risk register, the auditor findings and the change requests. The move is recent, so this is how we work today, not an audit result.
It does not issue the report, find you an auditor or collect evidence from your systems automatically. It does not test or score your controls: a criterion that has a control is mapped to one, and whether the control works is for your auditor to test. It has no public trust center page and no employee sign-off on policies. 21RISK covers the management side: criteria, controls, policies, approvals, evidence per period and the follow-up on findings.
Criteria, controls, policies and evidence for every period, with a login for your auditor.