SOC 2 + NIST CSF 2.0 Attestation
A SOC 2 examination with an added section addressing your controls against the NIST Cybersecurity Framework 2.0 subcategories across all six functions, the structure mid-market buyers, insurers and boards already use to ask about security.
- Criteria
- Public NIST CSF 2.0 text
- Report
- SOC 2 Type I or II with CSF section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + NIST CSF 2.0?
Vendors to mid-market and public-sector buyers
Their security questionnaires are organized by CSF function, and a SOC 2 alone makes them do the translation.
Companies renewing cyber insurance
Carriers increasingly ask for posture evidence in CSF terms. A mapped report answers the application once.
Boards and audit committees
Directors want a framework they recognize. CSF is the common language between your security lead and your board.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing each control against CSF 2.0 subcategories across Govern, Identify, Protect, Detect, Respond and Recover, based on the mapping management prepares
- Test results for controls tied to the added subcategories, such as supply chain risk management and recovery communication
- A one-page summary by function you can drop into a questionnaire or board deck
What it is not
NIST does not certify or accredit anyone against the CSF, and there is no CSF certificate to earn. This is an independent CPA attestation that your controls are mapped to and tested against the framework. It does not replace NIST 800-171 or FedRAMP where a federal contract requires them.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm which CSF 2.0 functions and outcomes matter to the people reading the report.
- 2
Mapping
You map your controls to the CSF 2.0 subcategories. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
CSF-mapped controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the CSF section, organized by function.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Buyers asking in NIST terms?
Schedule a free 30-minute preliminary scope discussion and bring the questionnaire. We will tell you how much of it a SOC 2 + NIST CSF report answers.