Skip to content
StartupBuilderby Startups.Studio
Systems
Changelog
Trust and governance

Controls

Every control StartupBuilder runs, what it satisfies, and how its Evidence is tested.

Each control names the criteria it satisfies, the Processes and Systems that implement it, and its test.

ControlKindSatisfiesOwner
ConductpreventiveSOC2 CC1.1Legal Lead
Governance oversightdetectiveSOC2 CC1.2Founder
Role structurepreventiveSOC2 CC1.3, SOC2 CC2.2, ISO27001 A.5.2People Lead
Worker competencepreventiveSOC2 CC1.4, ISO27001 A.6.1, ISO27001 A.6.3, HIPAA 164.308(a)(5)People Lead
Action accountabilitypreventiveSOC2 CC1.5People Lead
Risk assessmentdetectiveSOC2 CC3.1, SOC2 CC3.2, SOC2 CC9.1, HIPAA 164.308(a)(1)Founder
Fraud screeningpreventiveSOC2 CC3.3Risk Analyst
Control wake reviewpreventiveSOC2 CC3.4, SOC2 CC5.1Compliance Officer
Control definitionpreventiveSOC2 CC5.1, SOC2 CC5.3Compliance Officer
Inherited floorspreventiveSOC2 CC5.1, SOC2 CC5.2Compliance Officer
Policy approvaldetectiveSOC2 CC5.3, ISO27001 A.5.1, HIPAA 164.316Founder
One-way Action windowspreventiveSOC2 CC5.1, SOC2 PI1.3Finance Lead
System descriptiondetectiveSOC2 CC2.2, SOC2 CC2.3Compliance Officer
Trust statusdetectiveSOC2 CC2.3Compliance Officer
Log completenessdetectiveSOC2 CC2.1, SOC2 CC7.2, ISO27001 A.8.15, ISO27001 A.5.28, HIPAA 164.312(b)Compliance Officer
Continuous control testingdetectiveSOC2 CC4.1, ISO27001 A.5.36, HIPAA 164.308(a)(8)Compliance Officer
Control samenessdetectiveSOC2 CC4.1, SOC2 CC5.2Compliance Officer
Adversarial control testingdetectiveSOC2 CC4.1, ISO27001 A.5.35Tester
Deviation closuredetectiveSOC2 CC4.2, ISO27001 A.5.36Compliance Officer
Authenticated ActionspreventiveSOC2 CC6.1, ISO27001 A.5.16, ISO27001 A.8.5, HIPAA 164.312(d)Security Engineer
Task-bound accesspreventiveSOC2 CC6.1, SOC2 CC6.3, ISO27001 A.5.15, HIPAA 164.308(a)(4), HIPAA 164.312(a)(1)Security Engineer
Permission decaydetectiveSOC2 CC6.2, SOC2 CC6.3, ISO27001 A.5.18, HIPAA 164.308(a)(4)Security Engineer
Permission wideningpreventiveSOC2 CC6.2, SOC2 CC6.3, ISO27001 A.8.2, ISO27001 A.5.18Security Engineer
Unseated accessdetectiveSOC2 CC6.2, SOC2 CC6.3, ISO27001 A.6.5, HIPAA 164.308(a)(3)Security Engineer
Secret rotationdetectiveSOC2 CC6.1, ISO27001 A.5.17Security Engineer
Namespace isolationpreventiveSOC2 CC6.1, SOC2 C1.1, ISO27001 A.8.3, GDPR Art.32Security Engineer
EncryptionpreventiveSOC2 CC6.1, SOC2 CC6.7, ISO27001 A.8.24, HIPAA 164.312(e)(1), GDPR Art.32Security Engineer
Boundary protectionpreventiveSOC2 CC6.6, ISO27001 A.8.20Security Engineer
Vulnerability managementdetectiveSOC2 CC7.1, ISO27001 A.8.8Security Engineer
Deploy reconciliationdetectiveSOC2 CC6.8, SOC2 CC7.1, SOC2 CC8.1, ISO27001 A.8.9Reliability Engineer
Append-only recordspreventiveSOC2 CC7.2, SOC2 PI1.5, ISO27001 A.5.33, HIPAA 164.312(c)(1)Security Engineer
Anomaly monitoringdetectiveSOC2 CC7.2, SOC2 CC7.3, ISO27001 A.8.16Reliability Engineer
Incident handlingdetectiveSOC2 CC7.3, SOC2 CC7.4, SOC2 CC7.5, ISO27001 A.5.24, ISO27001 A.5.26, HIPAA 164.308(a)(6)Reliability Engineer
Revert by querydetectiveSOC2 CC7.4, SOC2 CC7.5, ISO27001 A.5.26Reliability Engineer
Breach notificationdetectiveSOC2 CC7.3, SOC2 P6.3, SOC2 P6.6, HIPAA 164.404, GDPR Art.33, GDPR Art.34Privacy Officer
Change approvalpreventiveSOC2 CC8.1, ISO27001 A.5.3, ISO27001 A.8.25, ISO27001 A.8.32Engineering Lead
Agent definition evalspreventiveSOC2 CC8.1, ISO27001 A.8.29Quality Lead
Environment separationpreventiveSOC2 CC8.1, ISO27001 A.8.31Engineering Lead
Upstream reviewdetectiveSOC2 CC9.2, SOC2 CC6.4, SOC2 CC6.5, SOC2 P6.4, SOC2 P6.5, ISO27001 A.5.19, ISO27001 A.5.22, ISO27001 A.5.23, HIPAA 164.310(a)(1), GDPR Art.28Compliance Officer
Health data agreementspreventiveHIPAA 164.308(b)(1)Contracts Manager
Capacity headroomdetectiveSOC2 A1.1, ISO27001 A.8.6Reliability Engineer
Point-in-time recoverydetectiveSOC2 A1.2, SOC2 A1.3, SOC2 CC7.5, SOC2 CC9.1, ISO27001 A.8.13, ISO27001 A.5.29, ISO27001 A.5.30, HIPAA 164.308(a)(7)Reliability Engineer
Processing definitionspreventiveSOC2 PI1.1Product Lead
Input validationpreventiveSOC2 PI1.2Engineering Lead
Action completiondetectiveSOC2 PI1.3, SOC2 PI1.4Quality Lead
Outcome confirmationpreventiveSOC2 PI1.4Delivery Manager
Privacy noticedetectiveSOC2 P1.1, GDPR Art.13Legal Lead
Lawful basispreventiveSOC2 P2.1, SOC2 P3.1, SOC2 P3.2, SOC2 P6.1, GDPR Art.6, GDPR Art.7Privacy Officer
Purpose limitationpreventiveSOC2 P4.1, SOC2 C1.1, ISO27001 A.5.34, GDPR Art.5, GDPR Art.25Privacy Officer
Retention restrictionpreventiveSOC2 C1.2, SOC2 P4.2, SOC2 P4.3Privacy Officer
Privacy requestsdetectiveSOC2 P5.1, SOC2 P5.2, SOC2 P7.1, SOC2 P8.1, GDPR Art.15, GDPR Art.16, GDPR Art.17, GDPR Art.20, GDPR Art.21Privacy Officer
Disclosure recorddetectiveSOC2 P6.1, SOC2 P6.2, SOC2 P6.7Privacy Officer
Records of processingdetectiveGDPR Art.30, SOC2 P6.7Privacy Officer
Supplier bank detailspreventiveNone.Treasurer
Segregation of dutiespreventiveSOC2 CC5.1Finance Lead
Reconciliation completenesspreventiveSOC2 PI1.4Finance Lead
Manual Entry reviewpreventiveSOC2 PI1.2Finance Lead
Period sign-offdetectiveSOC2 CC4.1Finance Lead
Bank detail changespreventiveSOC2 CC6.1Treasurer

Compliance

Previous Page

Criteria

Next Page