Grimwatch

A SOC 2 Type II opinion covers a period. Your scanner shows today.

Every compliance tool on the market reports current state. Open the dashboard, see green. That is a moment.

The opinion your auditor writes covers twelve months. A control that ran for eleven of them failed the month it did not, and the question is never is this configured correctly — it is when was it not, and how would you know?

Nothing that scans your infrastructure today can answer that. Not because the scanners are bad, but because the answer is not present in the thing they read. A configuration screen has no memory.

What it produces

Two snapshots, taken three months apart, over a period that began a month before the first one. That is the entire input:

# Control period record

**Period** 2025-12-01 to 2026-07-01 (212 days)
**Snapshots** 2
**Resolution** 91 days — the widest interval in which a change could go unseen
**Unevidenced at the start** 2025-12-01 to 2026-01-01 (31 days). No control is
evidenced here and none can be, retroactively.

## Scoring sheet

| Control | Status at period end | Met | Exceptions |
|---------|----------------------|-----|------------|
| B3      | unknown              |  0% | 1          |
| D2      | met                  | 85% | 1          |
| E1      | met                  | 85% | 1          |
| E5      | not_addressed        | 42% | 2          |

Status is observed at each snapshot and inferred between them; the status at the
last snapshot is carried forward to the period end. The Met column is therefore
an inference from 2 observations, not 212 days of continuous evidence.

## Exceptions

### E5

- **unknown**, 2025-12-01 to 2026-01-01 (31 days). No snapshot covers this
  interval; it precedes the first one. This cannot be remediated, only disclosed.
- **not_addressed**, 2026-04-01 to 2026-07-01 (91 days). First observed
  2026-04-01; the preceding observation was 2026-01-01, so the exception may
  have begun as early as then — 181 days of exposure that cannot be excluded.

The top line of that scoring sheet is what every other tool sells you. The section underneath it is the deliverable.

Three things a scan cannot tell you

The blind window. The period began 1 December. The first snapshot was 1 January. Thirty-one days are evidenced by nothing at all — and unlike a misconfiguration, this cannot be fixed. No change made today creates evidence for last December. It can only be disclosed, and disclosing it yourself before the auditor finds it is a different conversation than the alternative.

Exposure, not discovery. E5 was fine on 1 January and not addressed on 1 April. The honest finding is not 91 days. Nobody looked in between, so the lapse may have begun the second of January. 181 days cannot be excluded. That is the number that belongs in the exceptions narrative, and reporting the smaller one is the kind of thing that gets found.

Resolution. Snapshots ninety days apart date every transition to within ninety days. A report that states its own precision is worth more than one that implies a precision it does not have.

Four states, not two

A control is Met, Partial, Not addressed, or Unknown — and Unknown is not a soft No. It is the correct answer when the evidence source cannot speak to the question: a console that shows current state but no history, a log that begins in June for a period beginning in January.

Recording Unknown as “no” understates you. Recording it as “yes” is the thing that gets found. Most tools have no way to express it, so it becomes one of the other two, and which one depends on who built the tool.

What this is not

It is not an audit, and not an opinion. It is a self-assessment record, and every status in it rests on what the snapshots reported.

It does not prevent anything. It is not a guardrail, a policy engine, or a scanner. It witnesses, and it can prove what it saw and admit what it did not.

It does not replace your scanner. It needs one — or any other source that can produce a status per control. It is the layer that remembers.

Status

The assembly core is written and tested: a pure function over a slice of snapshots, no clock, no network, no storage. Same inputs, same record, recomputable by a third party.

Everything else — the collection side, the hosted period ledger, the share link an auditor can open without an account — is not built, because I would rather find out whether the problem is real first.

If your Type II period is open right now and you cannot say what a control’s status was in month two, I would like to hear about it. grace@gracefulco.de

Related: AI Controls for SOC 2 Type II, thirty-two controls with test procedures written for a period rather than a moment — the control set this assembles evidence against.