System description
Each entity’s system description renders from its Products, Systems, Roles, Processes and data classes, and re-renders on every Change.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC2.2 | The entity communicates internally the objectives and responsibilities for internal control that support its functioning. |
| SOC2 CC2.3 | The entity communicates with external parties about matters that affect the functioning of internal control. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every merged Change that alters an entity’s Products, Systems, Roles, Processes, Nouns or Integrations. |
| Assert | A new system description Version follows each one, and the officer’s period assertion is pinned to the latest Version’s hash. |
Owner
Compliance Officer, Legal Team.
Example
A clinic-scheduling SaaS adds the Payroll System. A new system description Version renders that day, and the officer's assertion pins its hash.