Johanson Group LLP is not a software tool but a licensed CPA firm (a firm of certified public accountants, which may sign attestation reports) that performs compliance and security audits. It audits companies against SOC 1, SOC 2 and SOC 3, ISO 27001, ISO 27017/18 and ISO 42001 (for AI management), and assesses them for HIPAA, GDPR, CCPA, PCI DSS and NIST. The site reports more than 4,000 clients.
SOC 2 is a report on a company's security controls, built on the AICPA's five Trust Services Criteria: security, which is always required, plus availability, confidentiality, processing integrity and privacy. Johanson Group offers a Type I audit, which checks the design of the controls on one date, and a Type II audit, which tests over a period of typically 6 to 12 months whether the controls also worked. The firm gives each client a customer success manager and audits inside the client's existing GRC (governance, risk and compliance) platform instead of manual exports. It states timelines of about 4 to 8 weeks.
It sells professional services, priced by quote for each engagement.