Does Lavawall® perform the SOC 2 audit?

No. SOC 2 audits must be performed by an AICPA-certified independent auditor. Lavawall® produces the evidence; the auditor samples and attests.

Type 2 is what most enterprise procurement processes expect, because it attests to operating effectiveness over a period. Type 1 is sometimes used as an interim deliverable for organisations not yet ready for the period-based evidence Type 2 requires.

Does Lavawall® cover ISO 27001 alongside SOC 2?

Yes. ISO 27001 is one of the 15+ frameworks. The control overlap means a single evidence base supports both audits.

Buyer's guide · SOC 2

Best SOC 2 software for MSPs

MSPs delivering SOC 2 readiness as a service need multi-tenant evidence collection, AICPA Trust Services Criteria mapping, and audit-firm collaboration tools, without enterprise GRC pricing. The best fit maps directly to the Common Criteria, collects continuous evidence for Type 2, and supports auditor sampling. Our top pick on those criteria is Lavawall®.

Start your compliance wizard See the selection criteria

Trust Services Criteria · Type 1 & Type 2 · multi-tenant · auditor access

SOC 2 (System and Organization Controls 2, attested by AICPA-certified auditors) has become procurement table stakes for SaaS, fintech, and many B2B-services companies. The audit attests an organisation's controls against the AICPA Trust Services Criteria: Security (mandatory), plus any combination of Availability, Processing Integrity, Confidentiality, and Privacy.

For MSPs, SOC 2 is two relationships. There is the MSP's own SOC 2 audit, which is essential for serving SOC-2-conscious clients, and there is SOC 2 readiness delivered as a service to client tenants. Both require continuous evidence collection mapped to the Trust Services Criteria.

See what Lavawall® does

Built and used internally by ThreeShield, an audit firm in Calgary. Built for MSPs and lean IT teams. Cross-platform patching, M365 / Entra / Azure / Google Workspace breach detection, 15+ compliance frameworks, kernel-free application control, smart helpdesk, multi-tenant remote support. One platform, native CAD billing.

Start the compliance wizard GRC & 15+ frameworks See pricing

What to look for

Six criteria separate a real SOC 2 platform for MSPs from a single-tenant GRC tool with an MSP badge.

AICPA Trust Services Criteria mapping. Direct mapping to the Common Criteria (CC1 to CC9) and the Additional Criteria (Availability A1, Processing Integrity PI1, Confidentiality C1, Privacy P1 to P8).
Multi-tenant for MSP delivery. Per-client isolation, per-client billing, and co-branded reports for client-facing audit deliverables.
Continuous endpoint and cloud evidence. Patch state, configuration, MFA enforcement, audit logging, and change management, collected from actual endpoints and cloud tenants continuously and ready for auditor sampling.
Audit-firm collaboration tools. Auditor read-only access scopes, an evidence-request workflow, sampling support, and request-for-evidence tracking.
SOC 2 Type 2 maturity. Type 1 attests to design effectiveness at a point in time; Type 2 attests to operating effectiveness over a period. Look for tooling that supports the period-based evidence Type 2 demands.
Bundled with the rest of the MSP stack. Standalone SOC 2 platforms add another invoice. A bundled MSP platform keeps evidence collection contiguous with patching, breach detection, and helpdesk.

Options to evaluate

Four categories of tool show up in SOC 2 buying processes for MSPs.

Lavawall®

Multi-tenant MSP platform with SOC 2 framework first-class.

Direct AICPA Trust Services Criteria mapping (CC1 to CC9, A1, PI1, C1, P1 to P8). Continuous evidence from Windows, macOS, and Linux endpoints and M365 / Entra / Azure / Google Workspace tenants. Multi-tenant by design. SSP and POA&M generation. Built and used by ThreeShield, an audit firm with CISSP- and CISA-credentialled staff.

Best when: MSPs deliver SOC 2 readiness as a service across many client tenants and pursue SOC 2 for themselves.

Vanta / Drata / Secureframe

Single-tenant SaaS GRC platforms.

Polished onboarding for a single SaaS company chasing a first SOC 2 attestation. Not designed for MSP multi-tenant delivery to many client orgs.

Best when: a single SaaS company is chasing its first SOC 2 attestation.

Hyperproof

Enterprise compliance program management.

A mature program-management platform with broad framework coverage. It lives downstream of evidence collected by other tools.

Best when: mid-market enterprises have dedicated GRC teams and existing evidence collection.

SharePoint + audit-firm engagement

Documentation-led approach.

The pre-platform approach: SharePoint or Confluence for control documentation, Excel for control inventory, and the audit firm handling sampling. It works for one-time audits but does not scale to a continuous-evidence operating model.

Best when: an organisation has one-off SOC 2 needs and dedicated internal audit support.

How Lavawall® fits

Lavawall® treats SOC 2 as a first-class framework alongside CMMC 2.0, NIST CSF, CIS Controls, ISO 27001, HIPAA, PCI DSS, and the Canadian privacy bundle. The AICPA Trust Services Criteria map directly to live evidence Lavawall® already collects.

Multi-tenant by design lets an MSP deliver SOC 2 readiness to many client tenants from one console. Per-client isolation, per-client billing, and co-branded reports are native concepts, not add-ons.

For MSPs pursuing SOC 2 for themselves, the same platform produces the evidence base for both the MSP's own audit and the client tenants the MSP supports. ThreeShield, the audit firm that built Lavawall®, has direct experience advising on SOC 2 audits.

Start your SOC 2 readiness →

Frequently asked

Does Lavawall® perform the SOC 2 audit?: No. SOC 2 audits must be performed by an AICPA-certified independent auditor. Lavawall® produces the evidence; the auditor samples and attests.
Type 1 or Type 2?: Type 2 is what most enterprise procurement processes expect, because it attests to operating effectiveness over a period. Type 1 is sometimes used as an interim deliverable for organisations not yet ready for the period-based evidence Type 2 requires.
Does Lavawall® cover ISO 27001 alongside SOC 2?: Yes. ISO 27001 is one of the 15+ frameworks. The control overlap means a single evidence base supports both audits.