Criterion
A Criterion is one requirement of an outside framework, such as SOC 2 or GDPR, that one or more Controls satisfy.
Properties
| Property | Type | Required | Description |
|---|---|---|---|
framework | string | required | One of soc2, iso27001, hipaa, or gdpr. |
ref | string | required | The framework’s own reference, such as CC8.1. |
text | text | required | The requirement, paraphrased. |
Object
{
"$id": "https: //api.sb/ patentpad.com/ criteria/ criterion_1",
"$type": "Criterion",
"framework": "soc2",
"ref": "Example ref",
"text": "Example text"
}Relationships
None.
Verbs
getReturns one Criterion by id.GET /{namespace}/criteria/{id}listReturns Criteria, newest first, one page at a time.GET /{namespace}/criteria
A Criterion is kept forever and never edited: it has no update or delete.
Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.
| Operation | owner | admin | member | viewer |
|---|---|---|---|---|
Criterion.get | Yes | Yes | Yes | Yes |
Criterion.list | Yes | Yes | Yes | Yes |
Call it
Show me the latest criterion.Example
SOC 2 CC8.1 asks that changes be authorized, tested and approved before they reach production. Change approval satisfies it, and the same Control satisfies ISO 27001 A.8.32.