SOC 2 does not name a scanner, a scan interval or a fix deadline. The Security criteria, mainly CC7.1, expect you to have a process that detects vulnerabilities and configuration changes that introduce them, then evaluates and acts on what it finds. You define the process; the auditor tests that you follow it.
What the criteria say, in plain words
SOC 2 reports are built on the AICPA Trust Services Criteria. Paraphrased, CC7.1 asks that the organization use detection and monitoring procedures to identify changes that introduce new vulnerabilities and to find newly discovered vulnerabilities. CC7.2 to CC7.4 cover monitoring, evaluating events and responding. CC8.1 covers change management, which is where a fix pull request is reviewed.
The criteria are principles. The points of focus under them give examples, such as periodic scanning and timely remediation, but they are not a checklist you must copy. Check the current text of the criteria for exact wording.
Requirement versus what your policy must say
| Question | SOC 2 answer | What you decide |
|---|---|---|
| Must I run a scanner? | Detection is expected, tool is not named | Which scanners, for which assets |
| How often? | No fixed interval in the criteria | Your cadence, written in policy |
| How fast must I fix? | No deadline in the criteria | Your remediation targets by severity |
| Must I fix everything? | No | Exceptions with owner, reason and review date |
| Do I need a penetration test? | Not named as a requirement | Often added by customer demand |
Whatever you write becomes the standard you are tested against. An aggressive target you miss is worse than a realistic one you meet.
Steps to be ready
- Write a short vulnerability management policy: scope, scan cadence, severity levels, remediation targets, exception process.
- Run scans on code dependencies, container images and exposed services, and keep the output.
- Create a ticket or pull request for each finding that meets your threshold.
- Track time from detection to fix and keep the exceptions register.
- Review the policy at least yearly and record the review.
Type 1 reports look at design at a point in time. Type 2 reports look at operation across a period, so the evidence has to exist for the whole window.
Try it yourself
Open the framework mapping demo and see how one scan finding maps to several framework controls at once.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, so scan results and fix history can be kept as audit evidence. You can try a free scan.
Quick check
Is quarterly scanning required for SOC 2?
The criteria do not set an interval. Quarterly may be what your policy or a customer asks for, but the requirement is to follow the cadence you wrote down.
Do I have to fix every vulnerability to pass?
No. You need a defined process, evidence it runs, and documented decisions for items you accept or defer.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), aicpa-cima.com (criteria CC7.1 to CC7.4 and CC8.1, paraphrased).
Last reviewed: 19 October 2026.
