Criteria
Every framework criterion, with the controls that satisfy it.
Each criterion lists the controls that satisfy it, so every claim traces to Evidence.
| Criterion | Text | Controls |
|---|---|---|
| SOC2 CC1.1 | The entity demonstrates a commitment to integrity and ethical values. | Conduct |
| SOC2 CC1.2 | The board of directors is independent of management and oversees the development and performance of internal control. | Governance oversight |
| SOC2 CC1.3 | Management establishes, with board oversight, structures, reporting lines, authorities and responsibilities in pursuit of objectives. | Role structure |
| SOC2 CC1.4 | The entity attracts, develops and retains competent individuals in alignment with its objectives. | Worker competence |
| SOC2 CC1.5 | The entity holds individuals accountable for their internal control responsibilities in pursuit of objectives. | Action accountability |
| SOC2 CC2.1 | The entity obtains or generates and uses relevant, quality information to support internal control. | Log completeness |
| SOC2 CC2.2 | The entity communicates internally the objectives and responsibilities for internal control that support its functioning. | Role structure, System description |
| SOC2 CC2.3 | The entity communicates with external parties about matters that affect the functioning of internal control. | System description, Trust status |
| SOC2 CC3.1 | The entity specifies objectives precisely enough to identify and assess the risks that relate to them. | Risk assessment |
| SOC2 CC3.2 | The entity identifies risks to its objectives across the entity and analyzes them to decide how to manage them. | Risk assessment |
| SOC2 CC3.3 | The entity considers the potential for fraud when it assesses risks to its objectives. | Fraud screening |
| SOC2 CC3.4 | The entity identifies and assesses changes that could significantly affect the system of internal control. | Control wake review |
| SOC2 CC4.1 | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. | Continuous control testing, Control sameness, Adversarial control testing, Period sign-off |
| SOC2 CC4.2 | The entity evaluates internal control deficiencies and communicates them in time to the parties responsible for corrective action. | Deviation closure |
| SOC2 CC5.1 | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. | Control wake review, Control definition, Inherited floors, One-way Action windows, Segregation of duties |
| SOC2 CC5.2 | The entity selects and develops general control activities over technology to support its objectives. | Inherited floors, Control sameness |
| SOC2 CC5.3 | The entity deploys control activities through policies that set expectations and procedures that put them into action. | Control definition, Policy approval |
| SOC2 CC6.1 | The entity implements logical access security software, infrastructure and architectures over protected information assets. | Authenticated Actions, Task-bound access, Secret rotation, Namespace isolation, Encryption, Bank detail changes |
| SOC2 CC6.2 | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. | Permission decay, Permission widening, Unseated access |
| SOC2 CC6.3 | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. | Task-bound access, Permission decay, Permission widening, Unseated access |
| SOC2 CC6.4 | The entity restricts physical access to facilities and protected information assets to authorized personnel. | Upstream review |
| SOC2 CC6.5 | The entity removes protections over physical assets only after the data on them can no longer be recovered. | Upstream review |
| SOC2 CC6.6 | The entity implements logical access security measures against threats from sources outside its system boundaries. | Boundary protection |
| SOC2 CC6.7 | The entity restricts the transmission, movement and removal of information to authorized parties, and protects it in transit. | Encryption |
| SOC2 CC6.8 | The entity prevents or detects the introduction of unauthorized or malicious software. | Deploy reconciliation |
| SOC2 CC7.1 | The entity uses detection and monitoring to identify configuration changes and newly discovered vulnerabilities. | Vulnerability management, Deploy reconciliation |
| SOC2 CC7.2 | The entity monitors system components for anomalies that indicate malicious acts, natural disasters or errors. | Log completeness, Append-only records, Anomaly monitoring |
| SOC2 CC7.3 | The entity evaluates security events to determine whether they are incidents that require a response. | Anomaly monitoring, Incident handling, Breach notification |
| SOC2 CC7.4 | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. | Incident handling, Revert by query |
| SOC2 CC7.5 | The entity identifies, develops and performs activities to recover from identified security incidents. | Incident handling, Revert by query, Point-in-time recovery |
| SOC2 CC8.1 | The entity authorizes, designs, develops, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures. | Deploy reconciliation, Change approval, Agent definition evals, Environment separation |
| SOC2 CC9.1 | The entity identifies, selects and develops risk mitigation activities for risks from potential business disruptions. | Risk assessment, Point-in-time recovery |
| SOC2 CC9.2 | The entity assesses and manages risks associated with vendors and business partners. | Upstream review |
| SOC2 A1.1 | The entity maintains, monitors and evaluates processing capacity and use to manage demand and add capacity. | Capacity headroom |
| SOC2 A1.2 | The entity designs, operates, monitors and maintains environmental protections, backups and recovery infrastructure. | Point-in-time recovery |
| SOC2 A1.3 | The entity tests the recovery plan procedures that support system recovery. | Point-in-time recovery |
| SOC2 C1.1 | The entity identifies and maintains confidential information to meet its confidentiality objectives. | Namespace isolation, Purpose limitation |
| SOC2 C1.2 | The entity disposes of confidential information to meet its confidentiality objectives. | Retention restriction |
| SOC2 PI1.1 | The entity generates and communicates relevant, quality information about processing, including definitions of the data it processes. | Processing definitions |
| SOC2 PI1.2 | The entity implements policies and procedures over system inputs so that they are complete and accurate. | Input validation, Manual Entry review |
| SOC2 PI1.3 | The entity implements policies and procedures over processing so that it is complete, accurate and timely. | One-way Action windows, Action completion |
| SOC2 PI1.4 | The entity makes outputs available, complete, accurate and timely, and only to authorized recipients. | Action completion, Outcome confirmation, Reconciliation completeness |
| SOC2 PI1.5 | The entity stores inputs, items in processing and outputs completely, accurately and on time. | Append-only records |
| SOC2 P1.1 | The entity notifies data subjects about its privacy practices. | Privacy notice |
| SOC2 P2.1 | The entity communicates choices about the collection, use, retention, disclosure and disposal of personal information, and obtains consent. | Lawful basis |
| SOC2 P3.1 | The entity collects personal information consistent with its privacy objectives. | Lawful basis |
| SOC2 P3.2 | The entity obtains explicit consent where it is required, and communicates the consequences of refusing. | Lawful basis |
| SOC2 P4.1 | The entity limits the use of personal information to the purposes identified in its objectives. | Purpose limitation |
| SOC2 P4.2 | The entity retains personal information consistent with its objectives. | Retention restriction |
| SOC2 P4.3 | The entity securely disposes of personal information consistent with its objectives. | Retention restriction |
| SOC2 P5.1 | The entity grants data subjects access to their stored personal information for review and copy. | Privacy requests |
| SOC2 P5.2 | The entity corrects or amends personal information at a data subject’s request and tells third parties of the change. | Privacy requests |
| SOC2 P6.1 | The entity discloses personal information to third parties only with the data subject’s consent. | Lawful basis, Disclosure record |
| SOC2 P6.2 | The entity keeps a complete, accurate and timely record of authorized disclosures of personal information. | Disclosure record |
| SOC2 P6.3 | The entity keeps a complete, accurate and timely record of detected or reported unauthorized disclosures, including breaches. | Breach notification |
| SOC2 P6.4 | The entity obtains privacy commitments from vendors and third parties with access to personal information, and assesses their compliance. | Upstream review |
| SOC2 P6.5 | The entity obtains commitments from vendors and third parties to tell it of any unauthorized disclosure of personal information. | Upstream review |
| SOC2 P6.6 | The entity notifies affected data subjects, regulators and others of breaches and incidents. | Breach notification |
| SOC2 P6.7 | The entity gives data subjects, on request, an accounting of the personal information it holds and its disclosures. | Disclosure record, Records of processing |
| SOC2 P7.1 | The entity collects and maintains accurate, up-to-date, complete and relevant personal information. | Privacy requests |
| SOC2 P8.1 | The entity receives, addresses and resolves privacy inquiries, complaints and disputes, and monitors its own compliance. | Privacy requests |
| ISO27001 A.5.1 | Information security policies are defined, approved by management, published, communicated and reviewed at set intervals. | Policy approval |
| ISO27001 A.5.2 | Information security roles and responsibilities are defined and allocated. | Role structure |
| ISO27001 A.5.3 | Conflicting duties and conflicting areas of responsibility are segregated. | Change approval |
| ISO27001 A.5.15 | Rules control physical and logical access to information and assets, based on business and security requirements. | Task-bound access |
| ISO27001 A.5.16 | The full life of every identity is managed. | Authenticated Actions |
| ISO27001 A.5.17 | The allocation and management of authentication information is controlled. | Secret rotation |
| ISO27001 A.5.18 | Access rights are provisioned, reviewed, modified and removed according to the access control policy. | Permission decay, Permission widening |
| ISO27001 A.5.19 | Processes manage the information security risks of using supplier products and services. | Upstream review |
| ISO27001 A.5.22 | Supplier security practices and service delivery are monitored, reviewed and managed through change. | Upstream review |
| ISO27001 A.5.23 | Acquiring, using, managing and exiting cloud services follow the information security requirements. | Upstream review |
| ISO27001 A.5.24 | Incident management is prepared in advance, with defined processes, roles and responsibilities. | Incident handling |
| ISO27001 A.5.26 | Information security incidents are answered according to documented procedures. | Incident handling, Revert by query |
| ISO27001 A.5.28 | Records of information security events are identified, collected and preserved for later use. | Log completeness |
| ISO27001 A.5.29 | Information security holds at an appropriate level during a disruption. | Point-in-time recovery |
| ISO27001 A.5.30 | Technology readiness for business continuity is designed, implemented, maintained and tested. | Point-in-time recovery |
| ISO27001 A.5.33 | Records are protected from loss, destruction, falsification, unauthorized access and unauthorized release. | Append-only records |
| ISO27001 A.5.34 | Privacy and the protection of personal data meet applicable laws, regulations and contractual requirements. | Purpose limitation |
| ISO27001 A.5.35 | The approach to information security is reviewed independently at set intervals and after significant changes. | Adversarial control testing |
| ISO27001 A.5.36 | Compliance with the information security policy, rules and standards is reviewed on a set schedule. | Continuous control testing, Deviation closure |
| ISO27001 A.6.1 | Candidates are screened before joining and on an ongoing basis, in proportion to risk. | Worker competence |
| ISO27001 A.6.3 | Personnel receive security awareness, education and training relevant to their job. | Worker competence |
| ISO27001 A.6.5 | Security responsibilities that remain after termination or a change of job are defined and enforced. | Unseated access |
| ISO27001 A.8.2 | The allocation and use of privileged access rights is restricted and managed. | Permission widening |
| ISO27001 A.8.3 | Access to information and assets is restricted according to the access control policy. | Namespace isolation |
| ISO27001 A.8.5 | Secure authentication technologies and procedures are implemented according to access restrictions. | Authenticated Actions |
| ISO27001 A.8.6 | The use of resources is monitored and adjusted in line with current and expected capacity needs. | Capacity headroom |
| ISO27001 A.8.8 | Information about technical vulnerabilities is obtained, exposure is evaluated, and measures are taken. | Vulnerability management |
| ISO27001 A.8.9 | Configurations, including security configurations, are established, documented, implemented, monitored and reviewed. | Deploy reconciliation |
| ISO27001 A.8.13 | Backup copies of information, software and systems are maintained and tested on a set schedule. | Point-in-time recovery |
| ISO27001 A.8.15 | Logs of activities, exceptions, faults and other relevant events are produced, stored, protected and analyzed. | Log completeness |
| ISO27001 A.8.16 | Networks, systems and applications are monitored for anomalous behavior, and potential incidents are acted on. | Anomaly monitoring |
| ISO27001 A.8.20 | Networks and network devices are secured, managed and controlled to protect the information they carry. | Boundary protection |
| ISO27001 A.8.24 | Rules for the effective use of cryptography, including key management, are defined and implemented. | Encryption |
| ISO27001 A.8.25 | Rules for the secure development of software and systems are established and applied. | Change approval |
| ISO27001 A.8.29 | Security testing processes are defined and implemented in the development life of every system. | Agent definition evals |
| ISO27001 A.8.31 | Development, testing and production environments are separated and secured. | Environment separation |
| ISO27001 A.8.32 | Changes to information processing facilities and systems follow change management procedures. | Change approval |
| HIPAA 164.308(a)(1) | A covered entity implements policies and procedures to prevent, detect, contain and correct security violations, including risk analysis. | Risk assessment |
| HIPAA 164.308(a)(3) | Workforce members get appropriate access to electronic protected health information, and others are prevented from obtaining it. | Unseated access |
| HIPAA 164.308(a)(4) | Access to electronic protected health information is authorized consistent with the minimum necessary. | Task-bound access, Permission decay |
| HIPAA 164.308(a)(5) | The entity runs a security awareness and training program for every member of its workforce. | Worker competence |
| HIPAA 164.308(a)(6) | The entity identifies, responds to, mitigates and documents security incidents. | Incident handling |
| HIPAA 164.308(a)(7) | The entity keeps a contingency plan with data backup, disaster recovery and emergency mode operation. | Point-in-time recovery |
| HIPAA 164.308(a)(8) | The entity evaluates on a set schedule how well its security policies and procedures meet the rule. | Continuous control testing |
| HIPAA 164.308(b)(1) | A business associate handles protected health information only under satisfactory written assurances. | Health data agreements |
| HIPAA 164.310(a)(1) | Physical access to electronic information systems and the facilities that house them is limited to authorized access. | Upstream review |
| HIPAA 164.312(a)(1) | Systems that hold electronic protected health information allow access only to authorized persons or software. | Task-bound access |
| HIPAA 164.312(b) | Mechanisms record and examine activity in systems that hold electronic protected health information. | Log completeness |
| HIPAA 164.312(c)(1) | Electronic protected health information is protected from improper alteration or destruction. | Append-only records |
| HIPAA 164.312(d) | The entity verifies that a person or entity seeking access is the one claimed. | Authenticated Actions |
| HIPAA 164.312(e)(1) | Technical measures guard against unauthorized access to protected health information sent over a network. | Encryption |
| HIPAA 164.316 | The entity documents its security policies and procedures and retains that documentation for six years. | Policy approval |
| HIPAA 164.404 | A covered entity notifies each affected individual of a breach of unsecured protected health information without unreasonable delay. | Breach notification |
| GDPR Art.5 | Personal data is processed lawfully, fairly and transparently, for specified purposes, minimized, accurate, limited in storage and secure. | Purpose limitation |
| GDPR Art.6 | Processing is lawful only on a stated basis, such as consent, contract, legal obligation or legitimate interest. | Lawful basis |
| GDPR Art.7 | A controller shows that consent was given, and withdrawing consent takes no more effort than giving it. | Lawful basis |
| GDPR Art.13 | A controller tells data subjects its identity, purposes, legal basis, recipients, retention and their rights at collection. | Privacy notice |
| GDPR Art.15 | A data subject obtains confirmation of processing and a copy of their personal data on request. | Privacy requests |
| GDPR Art.16 | A data subject obtains correction of inaccurate personal data without undue delay. | Privacy requests |
| GDPR Art.17 | A data subject obtains erasure of personal data without undue delay when a listed ground applies. | Privacy requests |
| GDPR Art.20 | A data subject receives their personal data in a structured, machine-readable format and may move it elsewhere. | Privacy requests |
| GDPR Art.21 | A data subject objects to processing based on legitimate interest or for direct marketing, and marketing processing stops. | Privacy requests |
| GDPR Art.25 | A controller builds data protection into processing by design and processes only necessary data by default. | Purpose limitation |
| GDPR Art.28 | A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms. | Upstream review |
| GDPR Art.30 | Each controller and processor keeps a record of its processing activities. | Records of processing |
| GDPR Art.32 | Controllers and processors implement security appropriate to the risk, including encryption, resilience and regular testing. | Namespace isolation, Encryption |
| GDPR Art.33 | A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible. | Breach notification |
| GDPR Art.34 | A controller tells data subjects without undue delay about a breach likely to put them at high risk. | Breach notification |