SOC 2

Mapped to the Trust Services Criteria.

entityOS’s ISO/IEC 27001 & 27017-certified controls, expressed in the terms of the AICPA SOC 2 Trust Services Criteria — for customers who assess their vendors against SOC 2.

Trust Services CriteriaSSAE 18ISO 27001 mappingAWS SOC 1/2/3

A criteria alignment — not a SOC 2 report

entityOS does not currently hold its own SOC 2 attestation report. This page maps entityOS’s ISO/IEC 27001 / 27017-certified controls to the AICPA SOC 2 Trust Services Criteria, so customers who assess vendors against SOC 2 can see how each criterion is met. The AWS infrastructure entityOS runs on is itself independently SOC 1, SOC 2 and SOC 3 attested.

What SOC 2 is

A report, not a certificate.

SOC 2 is an attestation produced by an independent CPA firm under the AICPA’s SSAE 18 standard, reporting on how an organisation’s controls meet the Trust Services Criteria. A Type I report assesses the design of controls at a point in time; a Type II report assesses their operating effectiveness over a period, typically 3–12 months.

Layer 1

AWS — infrastructure

Independently attested under SOC 1, SOC 2 and SOC 3, and certified to ISO/IEC 27001, 27017 and 27018. entityOS inherits this foundation.

Layer 2

entityOS — platform

Certified to ISO/IEC 27001 & 27017 (currently in recertification to the 2022/2026 editions), with the controls below mapped to the SOC 2 Trust Services Criteria.

Layer 3

Your application

What you build in the isolated user-mode layer, and the data and consent decisions within it, remain your responsibility on top of the certified platform.

The five categories

Security, plus four.

Every SOC 2 covers Security (the Common Criteria). The other four categories are included where they are relevant to the service — all four are addressed by the entityOS ISMS.

Security

Common Criteria (CC1–CC9)

The mandatory core of every SOC 2 — protection of the system against unauthorised access, use or modification.

Required

Availability

Category A

The system is available for operation and use as committed.

Included

Processing Integrity

Category PI

Processing is complete, valid, accurate, timely and authorised.

Included

Confidentiality

Category C

Information designated confidential is protected as committed.

Included

Privacy

Category P

Personal information is collected, used, retained and disposed of per commitments.

Included

Common Criteria

Security — CC1 through CC9.

The Common Criteria are organised on the COSO framework. Each is met by controls already operating under the entityOS ISMS.

Ref	Criterion	How entityOS meets it	ISO 27001/17
CC1	Control Environment	CRO ownership of the ISMS; information-security policy as a condition of employment; a small, tertiary-qualified, long-tenured team; a disciplinary process with immediate termination on breach.	Cl.5 · A.5.1–5.4 · A.6.1–6.6
CC2	Communication & Information	A documented ISMS available to personnel and interested parties; internal and customer communications; a defined incident-notification process.	A.5.1, 5.2 · A.6.3, 6.8 · Cl.7.4
CC3	Risk Assessment	The ISO 27001 risk methodology (assets → threats → treatment); the CRO as risk owner; decisions recorded in the Statement of Applicability (v3.0).	Cl.6.1 · Cl.8.2–8.3
CC4	Monitoring Activities	The continuous automated real-time testing service, monitoring and logging, plus external ISO 27001/17 audit and surveillance.	A.8.16 · Cl.9.1–9.2
CC5	Control Activities	Controls selected and implemented per the SOA; separation of concerns (MVC); least-privilege enforced by the model.	A.5–A.8 · Cl.8.1
CC6	Logical & Physical Access	Role-based least-privilege across 700+ methods, TOTP/MFA and IP allowlisting; encryption in transit and at rest; tenant isolation; AWS physical access controls.	A.5.15–5.18 · A.8.2–8.5, 8.24 · A.7.x · 27017 8.35
CC7	System Operations	Continuous vulnerability scanning with 24-hour patching, a Web Application Firewall, real-time detection and alerting, and documented incident response.	A.8.7–8.8, 8.15–8.16 · A.5.24–5.27
CC8	Change Management	Change management over the fixed platform kernel; separated development, test and production; customers notified of changes that could affect them.	A.8.19, 8.31–8.32
CC9	Risk Mitigation	Supplier and vendor risk management (principally AWS); business-continuity and disruption controls; insurance.	A.5.19–5.22, 5.29–5.30

Additional categories

Availability, integrity, confidentiality, privacy.

The category-specific criteria, each mapped to the controls that satisfy them.

Ref	Category	How entityOS meets it	ISO 27001/17
A1	Availability	Real-time data-store duplication, warm standby and daily test-restores via AWS RDS; AWS multi-AZ; capacity management; continuous availability testing.	A.8.6, 8.13–8.14 · A.5.30
PI1	Processing Integrity	A typed model with validation on entry to and exit from each layer, encoded output, integrity hashing with optional on-chain anchoring, and complete logging.	A.8.24, 8.15 · 27017 guidance
C1	Confidentiality	Classification and need-to-know handling, encryption, tenant isolation, controlled deletion and secure disposal.	A.5.12–5.14, 8.10, 8.24 · 27017 8.35
P	Privacy	Privacy and PII protection under the Australian Privacy Act; data-location control (AWS Sydney by default); consent and retention governed by customer applications.	A.5.34 · ISO/IEC 27018

ISO 27001 & SOC 2

One ISMS, two languages.

ISO 27001 and SOC 2 share a large proportion of their controls.

ISO/IEC 27001 certifies a management system against a fixed global standard. SOC 2 reports, in a US-oriented format, on how controls meet the Trust Services Criteria — a Type II report over a period of time. entityOS operates a single ISMS that satisfies both control sets; this page simply expresses it in SOC 2 terms. The most efficient path to a SOC 2 examination, when required, is to build on the existing ISO-certified controls rather than stand up a separate programme.

Assurance today

What we can give you now.

entityOS provides assurance through its ISO/IEC 27001 & 27017 certification (see the certificates and the Director’s Statement covering the current recertification), its Statement of Applicability (v3.0), this Trust Services Criteria mapping, and the AWS SOC 1/2/3 reports covering the infrastructure layer. A formal entityOS SOC 2 examination is not currently held.

Statement of Applicability Certificates Director’s Statement