Vooki Pro's SOC 2 compliance report is a SOC 2 / 2017 Trust Services Criteria — selected control mapping (CC6.1, CC6.2, CC6.6, CC6.7, CC6.8, CC7.1 and CC7.2). It reorganizes DAST findings against seven Common Criteria, so scan results can sit alongside the other evidence your auditor reviews. It is a vulnerability-report mapping — not a SOC 2 attestation, not an auditor-issued SOC 2 report, and not a certification.
SOC 2 is part of the AICPA's SOC suite: an examination, performed by an independent CPA firm, of a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. Only that CPA firm issues a SOC 2 report.
The Trust Services Criteria include Common Criteria for logical and physical access (the CC6 series) and system operations (the CC7 series). Evidence that an application was tested for vulnerabilities, and that findings were fixed and retested, is one input an auditor may consider for those areas — alongside many controls a scanner can't evidence.
| Criterion | Series | What Vooki Pro maps findings against |
|---|---|---|
| CC6.1 | Logical and physical access | Logical access security controls over protected information assets |
| CC6.2 | Logical and physical access | Registration and authorization of new users before granting access |
| CC6.6 | Logical and physical access | Protection against threats from outside the system boundaries |
| CC6.7 | Logical and physical access | Restricting the transmission and movement of information |
| CC6.8 | Logical and physical access | Preventing or detecting unauthorized or malicious software |
| CC7.1 | System operations | Detecting and monitoring configuration changes and vulnerabilities |
| CC7.2 | System operations | Monitoring system components for anomalies and security events |
Descriptions are Vooki Pro's own short labels for each mapped criterion, not the AICPA's criterion text.
Each finding from a scan is placed under the criteria it bears on, with its evidence, severity and remediation guidance, in HTML or PDF. It shows what was tested and what was found for one application at the time of the scan — useful supporting documentation for the access and system-operations areas above.
Only the seven criteria above are mapped. The remaining Common Criteria, and the availability, processing integrity, confidentiality and privacy categories, are outside the report. Using Vooki Pro does not make an organization “SOC 2 compliant” — that conclusion belongs to your CPA firm's examination of your controls as a whole.
Open a scan, choose Export → Compliance Report, select SOC 2, and save it as HTML or PDF. From the CLI, set report_type to compliance and compliance_framework to sox — the CLI's value for this SOC 2 report; soc2 is also accepted as an alias.
See the report generator docs for exporting evidence · or browse other frameworks
AICPA & CIMA — SOC suite of services (incl. SOC 2)
AICPA & CIMA — 2017 Trust Services Criteria (download page)
Vooki Pro documentation: Reports & Compliance · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.