SOC 2 compliance,
as a system.
For B2B software companies facing a first SOC 2 request from an enterprise customer — usually with a date attached. One complete, downloadable document system built around a control matrix that maps SOC 2, NIST CSF 2.0 and the HIPAA Security Rule on the same row. HIPAA add-on included.
Scope: Security, Availability and Confidentiality
The criteria mapping covers 38 criteria — CC1 to CC9, A1.1 to A1.3 and C1.1 to C1.2. Processing Integrity and Privacy are not covered. Most SOC 2 reports are Security-only, so this is a deliberate scope — stated here so you know it before you pay, not after.
Every document is delivered as an editable Word or Excel file with a consistent identifier — type, segment and number. The registers come with a user guide and a completed example.
| Security & access | Information Security Policy · Access Control · Acceptable Use · Encryption & Cryptography · Workstation & Endpoint · Data Classification |
| Operations & change | Change Management · Risk Assessment & Management · Vendor & Third-Party Risk · Vulnerability Management · Log Management & Monitoring |
| Availability & resilience | Incident Response Plan · Business Continuity & DR Plan |
| People & governance | Internal Audit · Security Awareness & Training · Onboarding & Offboarding · Roles & Responsibilities (RACI) |
| Registers & audit artifacts | Risk Register · Control Matrix · Evidence Tracker · Vendor Inventory · System Description |
| HIPAA add-on | HIPAA Security Rule Policies · PHI Data Handling Procedure |
Does this produce a SOC 2 report?
No. Only a licensed CPA firm issues a SOC 2 report. This gives you the documentation a readiness assessment starts from: policies, registers, the control matrix and a system description your auditor can work with.
What does "mapped both ways" mean?
One sheet maps each control to the criteria it satisfies; another maps each criterion to the control that owns it. That second direction is a coverage check — you can show that every criterion has an owner. Single-direction matrices miss gaps by construction.
Is AICPA source text reproduced in the documents?
No. The documents reference criterion numbers; the Trust Services Criteria text itself is not reproduced.
Is there a smaller or cheaper version?
No. SOC 2 is sold as one complete system, so you never pay twice for documents you already own.
What exactly do I receive after payment?
A single .zip with all documents in editable Word and Excel formats, delivered by email within seconds. Tax invoice generated automatically by Gumroad.
I'm a consultant — can I use one purchase across clients?
Each licence covers one entity. Consultants need one licence per client — or see the GRC Platform Consultant licences for multi-client workspace rights.
More questions? Read the full FAQ →
One system, one price
Start the readiness assessment with the documents already in place.
24 editable documents, HIPAA add-on included. Updates included for 12 months.
SOC 2 is a service mark of the American Institute of Certified Public Accountants. AltShift is not affiliated with or endorsed by the AICPA.
Pair with the US Compliance Workspace
Your SOC 2 documents, operated in Notion.
The documents define what you must do. The workspace is where your team records that it is being done, and where an auditor can see it. You enter what the documents specify — there is no automated import.
| In the document system | In the workspace | What it becomes |
|---|---|---|
| Control Matrix | Controls Catalogue | Your control set becomes the hub every other register links to — already mapped to TSC, NIST CSF 2.0 and HIPAA. |
| Evidence Tracker | SOC 2 Evidence Repository | Evidence collected per control across the audit period, ready for the auditor's requests. |
| Risk Register | Risk Register | Risks scored and linked to the controls that mitigate them. |
| Vendor Inventory · Vendor & Third-Party Risk | Vendor Risk Register | Subservice organisations and vendors tracked, including BAA status. |