// ToolkitSOC2.jsx — Verigo Global: SOC 2 implementation toolkit page const { V: TV, MAXW: TMW, FONT: TFT } = window; /* ── BREADCRUMB ──────────────────────────────────────────── */ const TkCrumb = ({ onNav }) => (
/ / SOC 2 Toolkit
); const tkCrumbBtn = { background: 'none', border: 'none', cursor: 'pointer', color: '#7A7A8A', fontSize: 13, fontWeight: 600, padding: 0, fontFamily: "'DM Sans', system-ui, sans-serif" }; /* ── HERO ────────────────────────────────────────────────── */ const TkHero = ({ onNav }) => (
Implementation Toolkit SOC 2 · Type I & II

The SOC 2 toolkit, ready to deploy.

A complete, practitioner-maintained document set — 20 policies, 16 procedures, and all 61 Trust Services Criteria control templates — tailored to your organization so you build an examination-ready control environment without starting from a blank page.

onNav('evaluation')}>Start the readiness evaluation document.getElementById('downloads')?.scrollIntoView({ behavior: 'smooth', block: 'start' })}>See what's inside
Inside the toolkit
{[['doc', '20', 'Approval-ready policies'], ['file', '16', 'Operational procedures'], ['layers', '61', 'Trust Services Criteria templates'], ['clipboard', '95+', 'Documents, checklists & samples']].map(([ic, n, l], i) => (
{n}
{l}
))}
); /* ── OVERVIEW ────────────────────────────────────────────── */ const TkOverview = () => (
Overview

Everything the examination tests — pre-built and tailored.

The Verigo SOC 2 toolkit is the document backbone of an examination-ready control environment. It pairs the security policies and procedures with implementation templates for every point of focus across the five Trust Services Criteria.

Each artefact is maintained by senior practitioners and tailored to your organization, systems, and selected criteria — then embedded into how you operate, the Compliance by Design way, so the evidence a Type II window needs is produced by the process itself.

{[ ['compass', 'Tailored, not generic', 'Every policy and procedure is shaped to your scope, systems, and existing tooling — not a one-size-fits-all template dump.'], ['network', 'Cross-framework ready', 'Controls are mapped so the same evidence supports ISO 27001, HIPAA, and NIST without duplication.'], ['refresh', 'Built for Type I and Type II', 'Stand up control design for a Type I, then run the evidence engine the Type II observation window will sample.'], ].map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── COVERAGE ────────────────────────────────────────────── */ const TkCoverage = () => (
Security · Common Criteria · CC1–CC9
{window.TK_SOC2.CC_SERIES.map(([n, t], i) => (
{n}
{t}
))}
Trust Services Criteria · five categories, 61 points of focus
{window.TK_SOC2.TSC.map((g, i) => (
{g.items.length}

{g.cat}

))}
); /* ── CONTENTS EXPLORER + GATED DOWNLOADS ─────────────────── */ const TkContents = ({ onDownload, unlocked }) => { const [tab, setTab] = React.useState('policies'); const A = window.TK_SOC2.ASSETS; const tabs = [['policies', 'Policies', A.policies.count], ['procedures', 'Procedures', A.procedures.count], ['controls', 'Criteria Templates', A.controls.count]]; const meta = A[tab]; const renderList = () => { if (tab === 'controls') { return (
{window.TK_SOC2.TSC.map((g, gi) => (
{g.cat} {g.items.length} criteria
{g.items.map(([code, title], i) => (
{code} {title}
))}
))}
); } const list = tab === 'policies' ? window.TK_SOC2.POLICIES : window.TK_SOC2.PROCEDURES; return (
{list.map(([t, d], i) => (
{String(i + 1).padStart(2, '0')}
{t}
{d}
))}
); }; return (
{tabs.map(([id, label, count]) => ( ))}
{meta.label}
{meta.blurb}
onDownload(tab)} style={{ flexShrink: 0 }}> {unlocked ? `Download PDF · ${meta.count} ${meta.unit}` : `Download PDF (${meta.count} ${meta.unit})`}
{renderList()}
); }; /* ── SAMPLE DOCUMENTS VIEWER ─────────────────────────────── */ const TkSamples = ({ onDownloadSample }) => { const [s, setS] = React.useState('policy'); const tabs = [['policy', 'Policy', 'doc'], ['procedure', 'Procedure', 'file'], ['control', 'Control template', 'layers'], ['checklist', 'Checklist', 'clipboard']]; return (
{tabs.map(([id, label, icon]) => ( ))}
Want the full sample?

Preview the complete package index as a branded PDF — we'll ask for a few details first.

Preview / download sample PDF

Samples are illustrative. Delivered documents are tailored to your organization and branding.

 ); }; const TkDocHeader = ({ docId, title, ver = '2.1', owner }) => (
{docId}

{title}

{[['Classification', 'Internal'], ['Version', ver], ['Owner', owner], ['Framework', 'AICPA SOC 2']].map(([k, v], i) => (
{k}
{v}
))}
); const TkDocSection = ({ n, h, children }) => (
{n}{h}
{children}
); const TkSamplePaper = ({ kind }) => { if (kind === 'policy') return (
This policy establishes the requirements for controlling logical and physical access to systems and data on a least-privilege, need-to-know basis, in support of Common Criteria CC6.1–CC6.3. Applies to all employees, contractors, and third parties who access organizational systems, applications, and data in scope for the SOC 2 examination.
  • Access is provisioned through a formal request and approval workflow tied to documented roles.
  • Privileged access is restricted, logged, and reviewed at least quarterly.
  • Multi-factor authentication is enforced for remote and administrative access.
  • Access rights are recertified every 90 days and revoked within 24 hours of a leaver event.
 System owners approve access; IT operations provisions it; the CISO owns this policy and its annual review. Reviewed annually or upon significant change. Next review: 12 months from approval.
); if (kind === 'procedure') return (
Define the repeatable steps for granting, modifying, and removing user access across the joiner–mover–leaver lifecycle, generating the evidence CC6.2 expects.
2.0Process steps
{[['1', 'Request raised', 'Manager submits an access request specifying role and systems.'], ['2', 'Approval', 'System owner validates least-privilege and approves or rejects.'], ['3', 'Provision', 'IT Operations creates accounts and assigns role-based entitlements.'], ['4', 'Verify', 'Requester confirms access; evidence logged to the ticket.'], ['5', 'Deprovision', 'On a leaver event, access is revoked within 24 hours and recorded.']].map(([n, t, d], i) => (
{n}
{t}
{d}
))}
Access request tickets, approval logs, and quarterly access-review reports are retained for the examination period.
); if (kind === 'control') return (
The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.
{[['Category', 'Security · Common Criteria'], ['Operating status', 'Operating'], ['Control owner', 'Head of IT Security'], ['Test frequency', 'Quarterly']].map(([k, v], i) => (
{k}
{v}
))}
MFA is enforced for all remote and privileged access; an identity provider mediates authentication; failed-attempt lockout and anomalous-login alerting are enabled across production systems. IdP configuration export, MFA enrolment report, access-control policy, and a sample of access logs demonstrating lockout behaviour.
); return (
{[['done', 'System description drafted and reviewed', 'Description'], ['done', 'Trust Services categories selected and scoped', 'TSC scope'], ['done', 'Control matrix mapped to every in-scope criterion', 'CC1–CC9'], ['progress', 'Evidence (PBC) tracker populated for the period', 'Evidence'], ['progress', 'Quarterly access reviews completed and logged', 'CC6.3'], ['todo', 'Vendor risk assessments current for subservice orgs', 'CC9.2'], ['todo', 'Incident response tabletop exercise documented', 'CC7.4']].map(([st, t, ref], i) => { const map = { done: [TV.purple, 'check', 'Complete'], progress: [TV.orange, 'refresh', 'In progress'], todo: [TV.g300, 'clipboard', 'Outstanding'] }; const [c, ic, lab] = map[st]; return (
{t}
{ref} {lab}
); })}
); }; /* ── PRICING ──────────────────────────────────────────────── */ const TkPricing = ({ onNav }) => { const TIERS = window.TK_SOC2.TIERS; const baseFmt = window.TK_SOC2.fmtPrice(window.TK_SOC2.QUOTE_BASE.price); return (
{TIERS.map((t,i)=>{ const pop=!!t.popular; return (
{pop&&
Most popular
}
{t.name}

{t.tagline}

{(t.features||[]).slice(0,4).map((f,fi)=>(
{f}
))}
); })}
onNav('checkout')}>Build custom package Starts from {baseFmt} · add only what you need · live pricing
); }; /* ── ONLINE EVALUATION PROMO ─────────────────────────────── */ const TkEvalBand = ({ onNav }) => { const steps = [ ['target', 'Answer ~30 questions', 'Mapped to specific SOC 2 criteria across CC1–CC9 and every optional category — about 12 minutes.'], ['gauge', 'Get your readiness score', 'An instant maturity score with a gap heat-map across all five categories.'], ['flag', 'See your next steps', 'A prioritized action plan showing exactly which toolkit documents close each gap.'], ]; return (
Online evaluation · ~10 minutes

Know where you stand before you start.

Our online SOC 2 readiness evaluation measures your current state against the Trust Services Criteria and maps every gap straight to the toolkit documents that close it. Get your score in about ten minutes.

onNav('evaluation')}>Start the evaluation onNav('evaluation')}>See how it works
{steps.map(([ic, t, d], i) => (
{String(i + 1).padStart(2, '0')}

{t}

{d}

))}
); }; /* ── PAGE ────────────────────────────────────────────────── */ const ToolkitSOC2Page = ({ onNav }) => { const [modalAsset, setModalAsset] = React.useState(null); const [unlocked, setUnlocked] = React.useState(false); const sessionOk = () => { try { return !!sessionStorage.getItem('verigo_dl_ok'); } catch (e) { return false; } }; React.useEffect(() => { if (sessionOk()) setUnlocked(true); }, []); const onDownload = (asset) => { if (sessionOk()) { window.TK_SOC2.generatePDF(asset, window.TK_SOC2.getUser() || {}); } else { setModalAsset(asset); } }; const onModalSubmit = (form) => { window.TK_SOC2.storeLead(form); try { sessionStorage.setItem('verigo_dl_ok', '1'); } catch (e) {} setUnlocked(true); const asset = modalAsset; setModalAsset(null); setTimeout(() => window.TK_SOC2.generatePDF(asset, form), 60); }; const A = modalAsset ? window.TK_SOC2.ASSETS[modalAsset] : null; return (
onDownload('standard')} /> {A && ( setModalAsset(null)} onSubmit={onModalSubmit} /> )}
); }; Object.assign(window, { ToolkitSOC2Page });