SOC 2 secure controls in 2025

SOC 2 reports help organisations handling sensitive customer data demonstrate how their security controls work. This article examines SOC 2 audit expectations and changes to supporting control frameworks, including the Secure Controls Framework.

Understanding the SOC 2 framework

The SOC 2 framework was developed by the American Institute of Certified Public Accountants (AICPA) to provide assurance about a service provider's cybersecurity controls. According to Sprinto, it's a voluntary compliance standard designed to protect sensitive customer data collected and processed by service organisations.

The framework is built on five Trust Services Criteria (TSC):

1. Security. This required criterion covers protection against unauthorised access.
2. Availability. Systems are operational and usable as committed.
3. Confidentiality. Information designated as confidential is protected.
4. Processing integrity. System processing is complete, accurate and authorised.
5. Privacy. Personal information is collected, used and retained appropriately.

While only Security is mandatory, most organisations pursuing SOC 2 include multiple criteria based on their business model and customer expectations.

Key SOC 2 updates for 2024-2025

Increased auditor scrutiny

Forvis Mazars reports that auditors are expected to intensify their scrutiny of inherent risk areas, leading to more meticulous examination of potential vulnerabilities. This means:

• More detailed evidence requirements for control effectiveness
• Greater focus on actual implementation versus documented policies
• Testing of technical controls as well as process controls

Zero trust integration

OCD Tech highlights that changes in SOC 2 compliance for 2025 include updates related to Zero Trust architecture. Organisations can no longer rely on perimeter-based security models. Auditors are increasingly expecting to see:

• Identity verification at every access point
• Microsegmentation of networks
• Continuous authentication and authorisation
• Least-privilege access models

AI and automation considerations

As AI becomes embedded in business processes, SOC 2 audits are evolving to address:

• AI governance frameworks and model risk management
• Automated control monitoring and its reliability
• Data handling in AI training pipelines
• Bias and fairness considerations for AI-driven decisions

The Secure Controls Framework (SCF): 2024-2025 updates

The Secure Controls Framework is an open-source meta-framework that maps controls across multiple compliance standards, including SOC 2/TSC. It's become an essential tool for organisations managing multiple compliance requirements.

Version 2024.1: STRM integration

This release introduced Set Theory Relationship Mapping (STRM) per NIST IR 8477, providing:

• More precise mapping between control frameworks
• Better identification of control gaps
• Improved efficiency in multi-framework compliance

Version 2024.2: major enhancements

This moderate update brought several significant changes:

PPTDF applicability tagging

Controls are now tagged based on People, Processes, Technology, Data & Facilities applicability. This helps organisations:

• Assign controls to the right teams
• Identify which controls require technical implementation versus policy changes
• Plan remediation efforts more effectively

MSP/MSSP secure practices baseline (SCF-M)

The SCF-M sub-control set helps organisations perform Cybersecurity Supply Chain Risk Management (C-SCRM) assessments of their Managed Service Providers (MSP) and Managed Security Service Providers (MSSP).

Use this baseline to assess the security controls of providers that handle your systems or data.

Version 2025.1.1: global privacy expansion

The latest release added support for the India Digital Personal Data Protection Act (DPDPA), continuing the SCF's expansion to cover global privacy regulations.

Practical implications for security teams

1. Continuous compliance is now expected

The traditional "point-in-time" approach to SOC 2 is giving way to continuous monitoring. Bright Defense notes that organisations need systems that can demonstrate ongoing compliance between audits.

Recommendations:

• Implement automated control monitoring
• Maintain continuous evidence collection
• Conduct regular internal assessments between audits

2. Supply chain risk management is non-negotiable

The SCF-M baseline can support service provider assessments. Ask:

• Do your MSPs/MSSPs have their own SOC 2 reports?
• How do you monitor vendor security posture continuously?
• What's your process for vendor security incidents?

3. AI governance needs attention now

If you use AI in your operations, put governance arrangements in place. This includes:

• Documenting AI use cases and risk assessments
• Establishing model validation and monitoring procedures
• Defining acceptable use policies
• Creating incident response procedures for AI failures

4. Zero trust access controls

Sprinto's SOC 2 updates guide emphasizes that Zero Trust principles are becoming baseline expectations. Start with:

• Identity and access management modernisation
• Network segmentation projects
• Continuous verification mechanisms

Plan evidence collection between audits

Use frameworks such as SCF to map controls across your compliance requirements and identify evidence you can reuse.

Assign owners to those controls and collect evidence between audits, rather than waiting for the annual review.

---

Ready to strengthen your compliance posture?

My IT compliance services help organisations assess gaps, prepare for audits and maintain their compliance programmes.

Get in touch to discuss your compliance challenges and how we can work together.