trio.so
SOC 2

SOC 2 compliance for every device you manage

Your SOC 2 auditor tests the controls on the laptops and phones your team uses. trio.so enforces those controls on every device, checks that they stay on, and keeps the evidence for your report. It covers Windows, macOS, Linux, iOS/iPadOS and Android from one console.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Frameworks  ›  SOC 2
  • Disk encryption is enabledCTL-ENC-01CC6.1
    critical8 devices
  • Firewall is onCTL-FW-01CC6.6
    high0 devices
  • Passcode is requiredCTL-PWD-01CC6.1
    high4 devices
  • Removable storage is blockedCTL-USB-01CC6.7
    medium5 devices
  • Real-time protection is onCTL-AM-01CC6.8
    high2 devices
Configuration policyFirewall · Windows and macOS
Resolved
Resolved after next evaluation
Audit trail

09:42Trio · Finding resolved · Firewall is on (CC6.6) · open → resolved after next evaluation · 6 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

Auditors test controls, not policies

A policy says laptops are encrypted. A Type 2 auditor asks you to show it, device by device, across months. Without a running record, that proof gets rebuilt from screenshots before every audit.

  • Every device countsCC6.7 covers laptops, phones, tablets and removable media such as USB drives.
  • Access keeps changingPeople join, change roles and leave. CC6.2 and CC6.3 ask that access follows.
  • Settings slipA firewall turned off for a quick test stays off until someone notices.
  • Proof over timeA Type 2 report tests that controls kept working for the whole period, not on one day.
Device evidence records collected in one place

How it works

How device management for SOC 2 works

Most teams collect SOC 2 device evidence by hand before each audit. With trio.so the checks run on a schedule, so the record builds up across the whole report period.

  1. Turn on SOC 2Activate the SOC 2 framework for the platforms you manage: Windows, macOS, Linux, iOS/iPadOS and Android.
  2. See what failsFindings list each failing control with the devices behind it, highest impact first.
  3. Fix and verifyFix the setting with a policy. The next check verifies it, and the audit trail records the result.
Start free trialBook a demo

Criteria

SOC 2 criteria trio.so helps you meet

SOC 2 is built on the AICPA's Trust Services Criteria. Most of it covers people, vendors and processes. These are the criteria that land on your devices, how trio.so helps, and where the evidence lives.

CriteriaHow trio.so helpsEvidence in trio.so
CC6.1Know and protect every device

Lists each device's owner, serial number, OS and installed apps, and enforces passcode and disk encryption policies.

The device list as a CSV export, and encryption check results for each device.

CC6.2 · CC6.3Access that follows joiners and leavers

Syncs users from Entra ID, Google Workspace or Okta. SCIM 2.0 provisioning creates and removes accounts as your directory changes.

The members list with roles, exportable as CSV.

CC6.5Retired and lost devices

Remote wipe erases a device before it is reassigned or retired. Remote lock and lost mode protect one that goes missing.

Each action and its result, recorded on the device.

CC6.7Laptops, phones and removable media

Passcode, encryption and WPA2 or WPA3 Wi-Fi policies on every device. USB storage blocked on Windows and Linux.

Policy status for each device: applied, failed or pending.

CC6.8Malware and unwanted software

Checks that anti-malware is active on each computer and shows Microsoft Defender for Endpoint alerts per device. The app inventory shows what is installed.

Check results for each device, with Defender alerts beside them.

CC7.1Configuration and vulnerabilities

Finds devices that fail configuration controls, ranks vulnerabilities by CVSS, EPSS and the KEV list, and patches the OS and third party apps on your schedule.

Findings for each control, and the patch history of every job.

Criteria from the AICPA 2017 Trust Services Criteria, with the revised points of focus (2022).

Controls

Enforce SOC 2 controls on every device

Your auditor picks a sample of devices and asks for the settings behind each control. trio.so pushes those settings as policies and reports back on every device: applied, failed or pending.

  • Disk encryptionBitLocker, FileVault and Linux disk encryption, with a check that confirms each device stays encrypted.
  • Passcode and lockMinimum length, auto-lock and lockout after failed attempts on laptops, iPhones, iPads and Android devices.
  • Removable mediaUSB storage blocked on Windows and Linux, for the removable media point in CC6.7.
  • Personal phonesAn Android work profile keeps company apps and data separate on employee owned phones.

Remediation

Track fixes and keep the record

Auditors look for problems and how you handled them. trio.so tracks each failing control until the next check confirms the fix, so the report period shows problems found and closed.

  • Fix with policiesPolicies set the missing control on the affected devices, such as turning the firewall back on.
  • Closed by evidenceA finding closes only when the next evaluation passes on that device.
  • Exceptions that expireAn exception names one control on one device and ends on a set date, so it can't sit unnoticed through a Type 2 period.
  • Who did whatThe audit trail records framework changes, evaluations and resolved findings.
A laptop failing a check, the setting fixed, and the laptop passing on the next check

See your SOC 2 findings in a free trial

Start a free trial, enroll a handful of laptops and phones, and activate SOC 2. The first evaluation shows which controls already pass on your own devices.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

SOC 2 checks on every platform

Your system description should match your evidence. Here is what trio.so checks on each operating system.

  • Windows
  • macOS

Windows and macOS

Windows: BitLocker, firewall, Secure Boot, OS updates and anti-malware. macOS: FileVault, screen lock, firewall, Secure Boot, OS updates and anti-malware. Every policy reports its status too.

  • Linux

Linux

Disk encryption, firewall and OS update signals, plus the status of core policies.

  • iOS/iPadOS
  • Android

iOS/iPadOS and Android

Passcode, encryption and other policies, checked as applied on each phone and tablet, including Android work profiles.

Evidence

Evidence for your SOC 2 auditor

A Type 2 auditor samples your controls across the whole period. trio.so keeps the record as it works, so the evidence is there when the request list arrives.

  • Device populationThe device list with owner and serial number, for your auditor's sample.
  • Control results by devicePass or fail for each mapped control, with when it was checked.
  • Evidence freshnessEach record shows its source and whether it is still fresh.
  • Resolved findingsWhen each failing control was verified fixed, device by device.
  • Patch historyWhat was patched, on which devices and when.
  • Access recordsConsole members with their roles, exportable as CSV.

Why trio.so

Compliance checks in the same console as your devices

SOC 2 work already spans a compliance tool, an MDM and a patch tool. trio.so brings the device part into one console, so the evidence comes from the system that enforces the setting.

  • Evidence from the source

    The console that sets a policy is the one that checks it and records the result.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    Support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

SOC 2 rarely stands alone. These pages cover the frameworks and features it overlaps with.

Integrations

Works with the tools you already use

Feed device results into Vanta for the rest of your SOC 2 program, see Microsoft Defender for Endpoint alerts per device, stream events to Splunk, alert your team in Slack or Microsoft Teams, and sync users from Microsoft Entra ID or Okta.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

SOC 2 FAQ

No tool can do that on its own. A SOC 2 report is issued by a CPA firm after it examines your company's controls. trio.so helps with the device side: it enforces the settings, checks them and keeps the evidence. Policies, vendor reviews, people controls and the audit itself stay with you and your auditor.

A Type 1 report looks at how your controls are designed at one point in time. A Type 2 report also tests that they worked over a period. trio.so's per-device status, findings and audit trail help most with Type 2, because they keep a running record. More in SOC 2 Type 1 vs Type 2.

Mostly the security criteria that touch devices: CC6.1, CC6.2, CC6.3, CC6.5, CC6.7 and CC6.8 for access and device protection, and CC7.1 for configuration and vulnerabilities. Availability, processing integrity, confidentiality and privacy are mostly outside device management.

Usually service companies that store or process customer data, such as SaaS and IT providers, once customers ask for proof of their security controls. What is SOC 2 compliance? covers who asks for it and why.

Scheduled checks evaluate every device again and open a finding when a control fails. You fix the setting with a policy, and the next evaluation confirms the fix. The audit trail keeps the whole history for your next report.

Often, because an MSP holds access to its clients' systems and clients ask for proof. A SOC 2 report covers the MSP's own controls. For the client side, trio.so's multi-client console keeps each client's devices, users and policies separate. See trio.so for MSPs.

Usually, yes. Policies, training, vendor reviews and the audit itself sit outside device management. trio.so works alongside tools like Vanta and connects to it. Our SOC 2 checklist walks through every criterion.