Switching GRC platforms in the middle of a SOC 2 cycle

OneTrust is retiring Tugboat Logic, which it also calls Certification Automation. According to the retirement FAQ published on July 16, 2026, renewals ended on August 31, 2026, standard support ends on August 31, 2027, and access stops when the subscription ends. For an organisation in the middle of a SOC 2 cycle, the question is not only which tool comes next: it is how to switch without breaking the period the auditor has to cover.

What the sources say

OneTrust, on the retirement. The retirement FAQ of July 16, 2026 sets the dates above and states that no extended support is offered. Customers have 60 days after their contract expires to retrieve their data. If an audit is under way, OneTrust asks customers to complete it in Certification Automation before exporting. Its migration guide of July 1, 2026 directs customers to its Tech Risk & Compliance product.

The AICPA, on what the auditor attests. The AICPA describes SOC as a suite of service offerings that certified public accountants (CPAs) may provide on the controls of a service organisation, and it sets the professional standards for those engagements. In a release dated October 19, 2026, it defines SOC 2 as "an independent examination performed by a licensed CPA under the AICPA Attestation Standards," whose report includes "an opinion on the design and operating effectiveness of controls supporting the system." The Trust Services Criteria are used to evaluate controls relevant to security, availability, processing integrity, confidentiality and privacy. The 2018 description criteria are used "when preparing and evaluating the description" of the system. Finally, an ethics staff note dated April 13, 2026 warns that business arrangements between CPA firms and SOC 2 tool providers can threaten the auditor's independence and objectivity, and the AICPA reminds readers that SOC services "should be thoroughly evaluated by service organizations and CPA firms."

Microsoft, on the period and bridge letters. Microsoft's SOC 2 documentation explains that a Type 2 report evaluates whether controls "were operating effectively over a specified time period." Microsoft's Type 2 audits examine a rolling 12-month period, with no gap allowed between consecutive periods. Between reports, Microsoft issues bridge letters, also called gap letters, which it describes as self-attestations, not reports based on an examination by the auditor.

Why it matters

The opinion covers the controls of the system described in the report. In most cases the GRC platform is not part of that system: it stores policies, assigns tasks and keeps evidence. Changing tools therefore does not change what is being audited. What can break is the continuity of evidence.

A Type 2 is tested over the whole period. If your Tugboat Logic contract ends halfway through the period, the evidence for the first months lives in a tool you are about to lose. It has to come out complete, with its dates, its authors and its link to the control it demonstrates. OneTrust's instruction to complete the audit before exporting, and the 60-day window, point the same way: the export is the only record that will remain.

The second point is less visible. Some controls are run by the tool itself: access review reminders, employee policy acceptance, automatic configuration collection. The day the old tool goes dark, those controls stop unless they have been picked up elsewhere. A week without a scheduled review becomes an exception in the report.

The third point concerns the auditor. The AICPA note on tool providers is a reminder that the firm has to remain independent of the tool. A migration is the moment to check that your auditor does not depend on the platform you are leaving, nor on the one you choose.

What we think at Sentrix

1. Set the switchover date with your auditor, before signing anything. Give them the contract end date, the end of the current period and the target report date. The SOC 2 page sets out the criteria involved.
2. Complete the current audit in the current tool, as OneTrust recommends, and switch only once the auditor's requests are satisfied.
3. Export the full history, not just the current state: dated evidence, approvals, policy versions, access reviews, exceptions and management responses, the vendor register. Keep a copy outside both tools, retained under your retention policy.
4. List the controls the tool ran by itself and plan their handover on the day of the switch, so that none of them pauses.
5. Leave no gap between two periods. A migration that delays the next period stretches the bridge letter; our article SOC 2 Type 1 or Type 2 explains how to chain periods.
6. Keep the auditor independent of the tool, whichever tool you pick.

Our Tugboat Logic migration page brings together the official dates and how we approach the export.

The next step

Write four dates on one line: the end of your Tugboat Logic contract, the end of your current observation period, the planned report date, and the start of the next period. If the first falls before the second, your switchover plan has to be ready before the contract ends. To build it with us, contact us.